WebView Integration

If you are embedding a web page inside a native mobile app on iOS or Android, you can pass tokens into the SDK to avoid requiring the customer to sign in again.

Constructor parameters

import { Tiquo } from '@tiquo/dom-package';

const tiquo = new Tiquo({
  publicKey: 'pk_dom_your_key_here',
  accessToken: 'eyJhbGciOiJSUzI1NiJ9...',
  refreshToken: 'rt_xxx...',
});

Global variable

Set the tokens before the SDK loads:

window.__TIQUO_INIT_TOKEN__ = {
  accessToken: 'eyJhbGciOiJSUzI1NiJ9...',
  refreshToken: 'rt_xxx...',
};

URL fragment

Append tokens to the URL when loading the WebView:

https://yoursite.com/page#access_token=eyJ...&refresh_token=rt_xxx

The SDK consumes the token fragment during initialization and removes the fragment with history.replaceState() when available. URL fragments are not sent as HTTP referrers, but constructor or global injection is preferable because credentials should not be left in copied URLs or browser history.

Initialize an existing instance

If the native bridge receives tokens after the SDK instance has been created, call:

tiquo.initWithTokens(accessToken, refreshToken);

This stores the supplied tokens, refreshes the customer session, and synchronizes the login with other tabs or WebViews that share the same browser storage context.

Injection priority

On construction, the SDK checks these sources in order and uses the first access token it finds:

1. accessToken and refreshToken constructor options
2. window.__TIQUO_INIT_TOKEN__
3. #access_token=...&refresh_token=... URL fragment

The global value is deleted after it is consumed. For security, inject only customer tokens obtained through an approved Tiquo authentication flow, restrict navigation in the WebView, and never expose tokens to arbitrary page origins.