Customer Authentication with the DOM Package

The DOM Package authenticates customers with an email OTP flow. The customer enters their email address, receives a 6-digit verification code, and signs in without a password or redirect.

Once authenticated, the SDK issues JWT access and refresh tokens that work with the Customer API.

For installation and initialization, see Setup.

Quick Start

import { Tiquo } from '@tiquo/dom-package';

// Initialize with your public key
const tiquo = new Tiquo({
  publicKey: 'pk_dom_your_key_here',
});

// Step 1: Send an OTP to the customer's email
await tiquo.sendOTP('customer@example.com');

// Step 2: Verify the OTP code the customer received
const result = await tiquo.verifyOTP('customer@example.com', '123456');

// The customer is now authenticated
const session = await tiquo.getUser();
console.log(session?.user.email);

Authentication Flow

Sending an OTP

Call sendOTP with the customer's email address. Tiquo will send a 6-digit verification code to that address.

try {
  await tiquo.sendOTP('customer@example.com');
  // Show the OTP input field in your UI
} catch (error) {
  console.error('Failed to send OTP:', error.message);
}

The email is sent from a branded sender that you can customize per domain in Settings > Website SDK. Each domain can have its own sender name and email theme.

Verifying an OTP

Call verifyOTP with the same email and the code the customer entered. On success, the SDK stores the JWT tokens and the customer is signed in.

try {
  const result = await tiquo.verifyOTP('customer@example.com', '123456');
  // Customer is now authenticated
  console.log('Signed in:', result.success);
} catch (error) {
  console.error('Verification failed:', error.message);
}

After successful verification, the SDK:

Stores the access token and refresh token in localStorage
Broadcasts the login event to other open tabs

Checking Authentication State

// Check if the customer is currently authenticated
const isLoggedIn = tiquo.isAuthenticated();

// Get the current user's profile (fetches from Customer API if needed)
const session = await tiquo.getUser();
if (session) {
  console.log(session.user.email);
  console.log(session.customer?.displayName);
  console.log(session.customer?.createdAt);
  console.log(session.customer?.firstActiveAt);
}

isAuthenticated() returns true when a valid access token exists or a refresh token is available to restore the session. getUser() validates or refreshes the tokens and loads the session through the Get Profile endpoint.

session.customer.createdAt and session.customer.firstActiveAt are optional, read-only Unix timestamps in milliseconds. See Created and First Active for their exact definitions and legacy-customer behavior.

How It Works with the Customer API

The DOM Package combines Auth DOM authentication with convenience wrappers for part of the Customer API. Here is the customer-data flow:

Your website loads the SDK and initializes it with your public key
The customer enters their email and receives a verification code
After verifying the code, Tiquo issues a JWT access token and refresh token
The SDK stores these tokens in the browser and adds the access token to its Customer API requests
When the access token expires, the SDK automatically calls the refresh endpoint to get a new pair
Customer API data exposed by the SDK (profile, orders, bookings, receipts, enquiries, and companies) is scoped to the authenticated customer

The SDK sends OTP requests to https://edge.tiquo.app/api/auth-dom/otp/send and https://edge.tiquo.app/api/auth-dom/otp/verify. Those Auth DOM operations are not part of the Customer API. After successful verification, customer-data helpers use the standard Customer API endpoints at https://edge.tiquo.app/api/client/v1/.

Customer Authentication