Dropped the duplicate `token` field from customer setup link create responses

Released: June 5, 2026

POST /v1/customers/{id}/setup_links Breaking

The response no longer includes a token field. The plaintext token is still returned exactly once — embedded in the path of setup_url.

Before:

{
  "id": "csl_...",
  "object": "customer_setup_link",
  "setup_url": "https://app.kirimdev.com/onboard/csl_xxxxxxxxxxxxxxxxxxxxxxxxxxxx",
  "token": "csl_xxxxxxxxxxxxxxxxxxxxxxxxxxxx"
}

After:

{
  "id": "csl_...",
  "object": "customer_setup_link",
  "setup_url": "https://app.kirimdev.com/onboard/csl_xxxxxxxxxxxxxxxxxxxxxxxxxxxx"
}

Migration

If you were reading response.token directly, switch to extracting it from response.setup_url:

const url = new URL(response.setup_url)
const token = url.pathname.split('/').pop() // 'csl_xxxxxxxx...'

Or — preferably — just hand the entire setup_url to your end customer as-is. That’s what the field is for.

@kirimdev/sdk Breaking

Bumped to 3.3.0. The CustomerSetupLinkWithToken interface no longer carries token. TypeScript will catch the migration for you at compile time.