> ## Documentation Index
> Fetch the complete documentation index at: https://docs.goliathdata.com/llms.txt
> Use this file to discover all available pages before exploring further.

# Configuration

> GoliathClient constructor options — base URL, timeouts, retries, and custom fetch

## Constructor options

```ts theme={null}
const goliath = new GoliathClient({
  apiKey,                                   // required — gsk_... from Settings → API keys
  baseUrl: 'https://server.goliathdata.com', // required — the API host
  timeoutMs: 60_000,                        // optional — per-attempt timeout (default 60s)
  maxRetries: 2,                            // optional — retry budget (default 2)
  fetch: customFetch,                       // optional — inject for non-Node runtimes/tests
})
```

| Option       | Required | Default        | Notes                                                                                               |
| ------------ | -------- | -------------- | --------------------------------------------------------------------------------------------------- |
| `apiKey`     | yes      | —              | Server-to-server credential. Never ship it to a browser or mobile app.                              |
| `baseUrl`    | yes      | —              | `https://server.goliathdata.com` for production.                                                    |
| `timeoutMs`  | no       | `60000`        | Applies per attempt, not per call — a retried call can take longer overall.                         |
| `maxRetries` | no       | `2`            | Governs the retry policy described in [Errors, retries & idempotency](/developer-api/sdk-errors).   |
| `fetch`      | no       | global `fetch` | Inject a custom implementation for edge runtimes, older Node versions, or request capture in tests. |

## Runtime requirements

The SDK targets server-side JavaScript runtimes with a WHATWG `fetch`
(Node 18+, or anything you inject via the `fetch` option). It is not intended
for browsers — not for technical reasons, but because the API key must not
leave your servers.

<Warning>
  **Keys are per-user, org-scoped**

  Every call executes as the key's owning user. Rotating the key owner's
  permissions (or deactivating the user) changes what the key can do — treat
  key ownership as part of your integration's configuration.
</Warning>