# Audius apps monorepo: one workspace holding the web app, mobile app, and protocol SDK

> The Audius apps repository is a Turborepo workspace where the web and desktop app, the iOS and Android app, the embed player, and the published TypeScript SDK live side by side. It is a strong reference for a blockchain product team, and a heavy place to start if you only want the SDK.

**AudiusProject/apps** — Audius apps monorepo - web / react native / typescript sdk

- Repository: https://github.com/AudiusProject/apps
- Website: https://audius.co
- Stars: 622 · Forks: 135
- Language: TypeScript
- License: Apache-2.0
- Published: 2026-10-22 · Updated: 2026-10-22 · Language: en
- Canonical page: https://hysenlabs.com/projects/audiusproject-apps

## The monorepo is the product, not a set of samples

Audius describes itself as a community-run music platform and the developer gateway to the Open Audio Protocol, and the apps repository is where that platform actually lives. It is a single npm workspace rooted at `package.json` with the `packages/*` glob, driven by `turbo.json` for task orchestration. The packages cover a lot of ground: a web and desktop app, an iOS and Android app, an embed player for third-party sites, the published `@audius/sdk`, the `harmony` design system, a `common` package of shared state and models, chain specific packages for Solana and Ethereum, a `fixed-decimal` utility, an identity service, a dev-stack CLI, and service definitions. The audience is a product engineering team working on a protocol with on-chain settlement, and the repository is set up to let the web, mobile, and embedded surfaces share one implementation of that protocol.

## npm install at the root sets up four toolchains at once

The Getting Started section of the README gives one command:

```bash
npm install
```

That single command does considerably more than fetch JavaScript packages. According to the README it installs the correct versions of node, ruby and python, installs dependencies including npm packages, gems and pods, sets up command line tools for interacting with the protocol as described in `dev-tools/README.md`, and initializes git hooks. The repository root confirms the shape of this: there is a `.nvmrc`, a `.ruby-version`, a `.pre-commit-config.yaml`, a `patches` directory, and `preinstall` and `postinstall` shell scripts wired into the root `package.json`. So a first-time clone expects a machine that can run a Ruby toolchain and install iOS pods, even if the immediate goal is only the web app.

## Every script is prefixed by the environment it targets

Running the apps is done through npm scripts that carry an environment prefix, and the README lists three: `*:dev` runs against local services, `*:stage` runs against the staging testnet, and `*:prod` runs against production infrastructure. A typical launch is:

```bash
npm run web
```

The root `package.json` shows how the convention is implemented. The `web` script delegates into the `@audius/web` workspace with `npm run start -w @audius/web`, and there are separate `web:local`, `web:test`, and `web:e2e` variants alongside example scripts that run from `packages/web/examples`, including trending, update-profile, upload, and gated-upload demos. The desktop entry point is different in kind: it uses `concurrently` to start the web process and then waits on `http://0.0.0.0:3002` before launching the Electron process against that port. Two implications follow. Environment selection is a naming convention spread across the whole script list, so you cannot infer a target environment from a script name alone without checking the package READMEs, and the desktop build assumes a fixed local port that a developer may already be using.

## Chain support is split into spl and eth packages

The package table is the fastest way to understand the architecture. `spl` holds Solana program instructions for Audius, and `eth` holds Ethereum governance and staking contract interactions, so the same application code can sit on either chain by depending on the right package. `fixed-decimal` supplies fixed-point decimal math utilities, which is what a token amount library needs to avoid floating point rounding. `common` holds shared state, models, and utilities for web and mobile, and `identity-service` is the auth and identity service rather than a client library, meaning a self-hosted deployment has a service to run and not just a package to import. The `commands` package is a CLI for performing actions against the dev stack, and `compose` holds audius-compose service definitions. The published npm packages visible in the README badges are `@audius/sdk`, `@audius/harmony`, `@audius/spl`, and `@audius/eth`, with the SDK most recently released as version 17.0.0 on 2026-09-24.

## The workspace relies on patches, changesets, and a secret scanner

The root `package.json` shows how the monorepo is kept consistent, and a few of those entries matter if you plan to contribute. Builds and tasks run through `turbo run`, with `lint`, `lint:fix`, `verify`, and `build` targets. There is a dedicated accessibility lint that fails the build when an empty `aria-label` appears in the web, harmony, or mobile sources, and a `check-secrets` script that runs `sh ./scripts/check-secrets.sh`. Dependency changes appear to be managed with `patch-package`, backed by the `patches` directory and a `patch-package` script, and the `.changeset` directory at the root indicates that version bumps are recorded as changesets before release. The `turbo-link` script runs `turbo login && turbo link`, which points to remote caching and means an external service account can become part of your build path.

## Contributing runs through pull requests, Discord, and a security inbox

The README invites contributions from anyone who opens a pull request and points to Discord for feedback. Security issues go to a dedicated address, `security@audius.co`, with a description of the vulnerability and steps to reproduce, and the README links to a bug bounty program page at audius.org/security. That arrangement matters for anyone embedding the SDK, because it tells you where a vulnerability report should go before you deploy. The licence is Apache 2.0, which keeps commercial use simple and provides an explicit patent grant, and the repository carries the LICENSE file at the root. The project was pushed to on 2026-10-20, and the recent releases include `@audius/spl` 2.2.0 and `@audius/sp-actions` 1.0.34 alongside the SDK release, all published on 2026-09-24, so the monorepo and its packages are shipping together.

## Where the monorepo is the wrong tool to reach for

The obvious temptation is to clone the repository to obtain `@audius/sdk`, and that is usually the wrong move. The install path pulls in four toolchains, sets up protocol command line tools, and initializes git hooks, none of which a consumer of the SDK needs. The repository also carries a `.claude` directory, a `CLAUDE.md` file, and a `.cursor` directory, so the workspace is shaped for contributors working inside it rather than for downstream users of a published package. A second limit is scope of responsibility: `identity-service` is a running service with its own configuration, and the `compose` package holds service definitions, so an evaluation of the protocol surface is not the same as an evaluation of what you must operate. The README also does not document an offline or air-gapped mode, and there is no mention of a stable release channel beyond the changesets workflow, so a consumer pinning a version should verify the published package contents rather than assume the monorepo state matches npm.

## Conclusion

The Audius apps monorepo is worth adopting as a reference if your team is building on the Open Audio Protocol, since the SDK, the embed player, and the identity handling are all here and the apps show how they are meant to be wired together. It is the wrong starting point if you only need `@audius/sdk`, because `npm install` at the root installs node, ruby and python versions, gems, pods, command line tools and git hooks across every package. Before you clone it, read `packages/sdk` on its own and decide whether a standalone SDK consumer is enough, then check the Apache 2.0 terms against your own distribution plans and confirm which chain packages, `spl` for Solana or `eth` for Ethereum, your integration actually needs.

## FAQ

### How do I set up the Audius apps monorepo locally?

The README gives `npm install` at the repository root. That command installs the correct versions of node, ruby and python, installs dependencies such as npm packages, gems and pods, sets up command line tools for interacting with the protocol, and initializes git hooks.

### How do I run the Audius web app against a local stack?

Environment is chosen by script prefix: `*:dev` runs against local services, `*:stage` against the staging testnet, and `*:prod` against production infrastructure. `npm run web` starts the web app, and `npm run web:local` is the local variant.

### What is the difference between the spl and eth packages in the Audius apps monorepo?

The `spl` package contains Solana program instructions for Audius, while `eth` contains Ethereum governance and staking contract interactions. Both are published to npm, as `@audius/spl` and `@audius/eth`.

### What license is the Audius apps monorepo released under?

Apache 2.0, with the LICENSE file at the repository root. The README notes that contributions are welcome through pull requests.

### How do I report a security issue in the Audius apps codebase?

Send the details to `security@audius.co` with a description of the vulnerability and steps to reproduce. The README also links to the bug bounty program information at audius.org/security.

## Sources

- [AudiusProject/apps on GitHub](https://github.com/AudiusProject/apps)
- [License: Apache-2.0](https://github.com/AudiusProject/apps/blob/main/LICENSE)
- [Project website](https://audius.co)
- [README](https://github.com/AudiusProject/apps/blob/main/README.md)
- [Releases](https://github.com/AudiusProject/apps/releases)

---

Hysen Labs editorial analysis, written from the project's own repository and release notes. Cite the canonical page: https://hysenlabs.com/projects/audiusproject-apps