Widget · JavaScript
Issue a secure widget session
Connect your authenticated partner server to an origin-bound customer session.
Before you begin
- Active Broker access and a server API key.
- An authenticated customer and an exact HTTPS origin configured in Team & Settings.
Implementation
- 1.Read the permanent key from your server secret store.
- 2.Derive the opaque endUserId from your authenticated customer, not request input.
- 3.Return the session only to that customer, with Cache-Control: no-store.
- 4.Mount the widget on the approved site; destroy and remount it after session expiry.
widget-session.js
// Partner server handler: authenticate the caller before this code.
// brokerApiKey comes from your server secret store.
export async function issueSession(brokerApiKey, authenticatedCustomer) {
const response = await fetch('https://tradeeyes.app/api/public/business/v1/sessions', {
method: 'POST',
headers: {
Authorization: 'Bearer ' + brokerApiKey,
'Content-Type': 'application/json'
},
body: JSON.stringify({
origin: 'https://partner.example',
endUserId: authenticatedCustomer.internalId
})
});
if (!response.ok) throw new Error('Session unavailable: ' + response.status);
const session = await response.json();
return new Response(JSON.stringify(session), {
headers: {
'Content-Type': 'application/json',
'Cache-Control': 'no-store'
}
});
}Validation & limitations
- Session lifetime is ten minutes; do not cache or log the token.
- Never return the permanent key to a browser.
- Revoked keys invalidate their issued sessions.