Basics

# Runtime library — used at runtime by servers and clients
npm install @grpc/grpc-js

# Protobuf loader — loads .proto files dynamically at runtime
npm install @grpc/proto-loader

# OR: code-generation path (recommended for production)
npm install -g grpc-tools          # installs protoc + grpc_node_plugin
npm install google-protobuf        # generated message helpers

yourservice.proto
      │
      ▼  protoc --js_out=. --grpc_out=. --plugin=protoc-gen-grpc=`which grpc_tools_node_protoc_plugin`
      │
      ├── yourservice_pb.js        (message classes)
      └── yourservice_grpc_pb.js   (service stubs)

const grpc = require('@grpc/grpc-js');
const protoLoader = require('@grpc/proto-loader');

const packageDef = protoLoader.loadSync('service.proto', {
  keepCase: true,       // preserve field names as-is
  longs: String,        // represent int64 as String (avoids JS precision loss)
  enums: String,        // enum values as strings
  defaults: true,       // fill in default values
  oneofs: true,         // virtual oneof fields
});
const proto = grpc.loadPackageDefinition(packageDef);

// Go — unary client (grpc.NewClient replaced grpc.Dial in grpc-go 1.63+)
conn, err := grpc.NewClient("localhost:50051",
	grpc.WithTransportCredentials(insecure.NewCredentials()))
defer conn.Close()
client := pb.NewUserServiceClient(conn)
ctx, cancel := context.WithTimeout(context.Background(), 5*time.Second)
defer cancel()
res, err := client.GetUser(ctx, &pb.GetUserRequest{UserId: 42})

# Python — unary client
import grpc
import service_pb2, service_pb2_grpc

with grpc.insecure_channel("localhost:50051") as channel:
    stub = service_pb2_grpc.UserServiceStub(channel)
    res = stub.GetUser(service_pb2.GetUserRequest(user_id=42), timeout=5)

const grpc = require('@grpc/grpc-js');

// Insecure (dev/internal)
const creds = grpc.credentials.createInsecure();

// TLS with system roots (production, no client cert)
const creds = grpc.credentials.createSsl();

// mTLS — custom CA + client cert/key
const creds = grpc.credentials.createSsl(
  rootCerts,    // Buffer — CA cert (or null for system roots)
  privateKey,   // Buffer — client private key
  certChain,    // Buffer — client certificate chain
);

// Combined: TLS + call credentials (e.g., token auth)
const callCreds = grpc.credentials.createFromMetadataGenerator((params, cb) => {
  const meta = new grpc.Metadata();
  meta.add('authorization', 'Bearer ' + getToken());
  cb(null, meta);
});
const combinedCreds = grpc.credentials.combineChannelCredentials(creds, callCreds);

// Create a channel (not a stub yet)
const channel = new grpc.Channel('localhost:50051', creds, {});

const options = {
  'grpc.keepalive_time_ms': 10_000,              // send ping every 10s
  'grpc.keepalive_timeout_ms': 5_000,            // wait 5s for ping ack
  'grpc.keepalive_permit_without_calls': 1,      // ping even with no active calls
  'grpc.max_receive_message_length': 4 * 1024 * 1024,   // 4 MB (default 4 MB)
  'grpc.max_send_message_length': 4 * 1024 * 1024,
  'grpc.enable_retries': 1,
  'grpc.service_config': JSON.stringify({
    methodConfig: [{
      name: [{}],
      retryPolicy: {
        maxAttempts: 4,
        initialBackoff: '0.1s',
        maxBackoff: '1s',
        backoffMultiplier: 2,
        retryableStatusCodes: ['UNAVAILABLE'],
      },
    }],
  }),
};