WebView Integration

If you are embedding a web page inside a native mobile app on iOS or Android, you can pass tokens into the SDK to avoid requiring the customer to sign in again.

Constructor parameters

import { Tiquo } from '@tiquo/dom-package';

const tiquo = new Tiquo({
  publicKey: 'pk_dom_your_key_here',
  accessToken: 'eyJhbGciOiJSUzI1NiJ9...',
  refreshToken: 'rt_xxx...',
});

Global variable

Set the tokens before the SDK loads:

window.__TIQUO_INIT_TOKEN__ = {
  accessToken: 'eyJhbGciOiJSUzI1NiJ9...',
  refreshToken: 'rt_xxx...',
};

URL fragment (opt-in)

The SDK ignores tokens in the URL fragment unless the page creates it with acceptUrlTokens: true:

const tiquo = new Tiquo({
  publicKey: 'pk_dom_your_key_here',
  acceptUrlTokens: true, // Only on pages your native app loads in its own WebView
});

Then append the tokens to the URL when loading the WebView:

https://yoursite.com/page#access_token=eyJ...&refresh_token=rt_xxx

Only turn this on for pages your native app opens in its own WebView. On a page anyone can open, someone could send a customer a link carrying their own tokens and sign the customer into the wrong account without them noticing. Constructor and global injection need code running in the page, which a link can't supply, so prefer them.

Whether the option is on or off, the SDK removes access_token and refresh_token from the fragment with history.replaceState() during initialization and keeps the rest of the fragment, so tokens don't stay in the address bar or browser history. When the option is off and the fragment carries an access token, the SDK logs a console warning.

Initialize an existing instance

If the native bridge receives tokens after the SDK instance has been created, call:

tiquo.initWithTokens(accessToken, refreshToken);

This stores the supplied tokens, refreshes the customer session, and synchronizes the login with other tabs or WebViews that share the same browser storage context.

Injection priority

On construction, the SDK checks these sources in order and uses the first access token it finds:

1. accessToken and refreshToken constructor options
2. window.__TIQUO_INIT_TOKEN__
3. #access_token=...&refresh_token=... URL fragment, only when acceptUrlTokens is true

The global value is deleted after it is consumed. For security, inject only customer tokens obtained through an approved Tiquo authentication flow, restrict navigation in the WebView, and never expose tokens to arbitrary page origins.