Customer Authentication with the DOM Package

The DOM Package authenticates customers with an email OTP flow. The customer enters their email address, receives a 6-digit verification code, and signs in without a password or redirect.

Once authenticated, the SDK issues JWT access and refresh tokens that work with the Customer API.

For installation and initialization, see Setup.

Quick Start

import { Tiquo } from '@tiquo/dom-package';

// Initialize with your public key
const tiquo = new Tiquo({
  publicKey: 'pk_dom_your_key_here',
});

// Step 1: Send an OTP to the customer's email
await tiquo.sendOTP('customer@example.com');

// Step 2: Verify the OTP code the customer received
const result = await tiquo.verifyOTP('customer@example.com', '123456');

// The customer is now authenticated
const session = await tiquo.getUser();
console.log(session?.user.email);

Authentication Flow

Sending an OTP

Call sendOTP with the customer's email address. Tiquo will send a 6-digit verification code to that address.

try {
  await tiquo.sendOTP('customer@example.com');
  // Show the OTP input field in your UI
} catch (error) {
  console.error('Failed to send OTP:', error.message);
}

The email is sent from a branded sender that you can customize per domain in Settings > Website SDK. Each domain can have its own sender name and email theme.

Verifying an OTP

Call verifyOTP with the same email and the code the customer entered. On success, the SDK stores the JWT tokens and the customer is signed in.

try {
  const result = await tiquo.verifyOTP('customer@example.com', '123456');
  // Customer is now authenticated
  console.log('Signed in:', result.success);
} catch (error) {
  console.error('Verification failed:', error.message);
}

After successful verification, the SDK:

Stores the access token and refresh token in localStorage
Sets a cross-subdomain cookie (tiquo_customer_user_ids) for tracking pixel integration
Broadcasts the login event to other open tabs

Checking Authentication State

// Check if the customer is currently authenticated
const isLoggedIn = tiquo.isAuthenticated();

// Get the current user's profile (fetches from Customer API if needed)
const session = await tiquo.getUser();
if (session) {
  console.log(session.user.email);
  console.log(session.customer?.displayName);
  console.log(session.customer?.createdAt);
  console.log(session.customer?.firstActiveAt);
}

isAuthenticated() checks whether a valid (non-expired) access token exists. getUser() returns the cached session data, or fetches it from the Get Profile endpoint if no cache is available.

session.customer.createdAt and session.customer.firstActiveAt are optional, read-only Unix timestamps in milliseconds. See Created and First Active for their exact definitions and legacy-customer behavior.

How It Works with the Customer API

The DOM Package is essentially a thin authentication layer on top of the Customer API. Here is the full flow:

Your website loads the SDK and initializes it with your public key
The customer enters their email and receives a verification code
After verifying the code, Tiquo issues a JWT access token and refresh token
The SDK stores these tokens in the browser and uses them for all Customer API requests
When the access token expires, the SDK automatically calls the refresh endpoint to get a new pair
All Customer API data (profile, orders, bookings, enquiries) is scoped to the authenticated customer

The SDK sends OTP requests to https://edge.tiquo.app/api/auth-dom/otp/send and https://edge.tiquo.app/api/auth-dom/otp/verify. After successful verification, it uses the standard Customer API endpoints at https://edge.tiquo.app/api/client/v1/.

Customer Authentication