Fetching token to embed an application

Some of apps provided by Placewise are available for embeding using dedicated token. These apps work in context of authorized member.

Available apps

App	Resource
Receipt Scanner	`placewise.com/component/web_form`
Rewards	`placewise.com/component/web_form`
Games (all)	`placewise.com/component/games_api`

Embed token security

Is opaque.

Embed token is single-use to prevent replay attacks.

It has 30 seconds TTL.

Application internally receives a session which:

is valid for 24 hours,

can not be refreshed (prolonged),

will be invalidated when the requester's OIDC session expires or terminates.

Fetching the token

In order to receive token, client must execute Embed/Create token request.

Embedding the application

Embed token can be passed to the application using one of three methods:

POST request

NOTE

Currently this method does not work for placewise.com/component/games_api

You can embed the application using POST HTTP request with application/x-www-form-urlencoded content-type and set embedToken=<embed-token> parameter.

Header

NOTE

Currently this method does not work for placewise.com/component/games_api

Add embed-token: <embed-token> header to embedding request.

Query param

WARNING

This method is the least secure.

Even though the embed token is single-use and short-lived, we suggest using other options if possible.

You can pass embedToken=<embed-token> query parameter.

Fetching token to embed an application

Available apps#

Embed token security#

Fetching the token#

Embedding the application#

POST request#

Header#

Query param#

Available apps

Embed token security

Fetching the token

Embedding the application

POST request

Header

Query param