Boxo Connect

​

Prerequisites

• User authorization system

​

Boxo Connect flow

1. User opens host app and launches miniapp: The user opens the host app and starts the miniapp.
2. User should be identified to proceed with the flow: This could involve product purchase, user registration, etc.
3. appboxo.login() is called from inside the miniapp: The miniapp requests a login action via Boxo’s SDK.
4. User is asked for confirmation to give access to personal data: The user is prompted to confirm sharing personal data necessary for the miniapp’s authorization process.
5. Boxo’s native SDK gets the auth code generated by the host app: Boxo SDK receives the authorization code and sends an HTTPS request to the Boxo platform with the auth code.
6. Boxo’s platform sends an HTTPS request to the host app backend: The Boxo platform sends the auth code to the host app’s backend for validation.
7. Host app backend validates the auth code and returns an access token: The backend checks the auth code and sends back an access token.
8. Boxo’s platform sends an HTTPS request to the host app backend to get user data: The Boxo platform requests the user data from the host app backend using the access token.
9. Host app backend validates the access token and returns user data: The host app backend confirms the validity of the access token and sends the user data back.
10. Boxo’s platform sends an HTTPS request with the user data to the miniapp backend: Boxo platform forwards the user data to the miniapp backend for processing.
11. Miniapp backend either registers a new user or identifies an existing one: The miniapp backend registers the user or identifies the existing user, then sends an authorization token back to Boxo platform.
12. Boxo platform sends back the authorization token to the Boxo native SDK: The authorization token is sent back to the Boxo SDK that initiated the request.
13. Authorization token is passed to the miniapp: The token is provided to the miniapp.
14. Miniapp makes a request with the token to get user data from the miniapp backend: The miniapp sends the token to its backend for user data.
15. Miniapp backend recognizes the token and sends back user data: The miniapp backend verifies the token and returns the user data.
16. User is authorized and continues with the miniapp flow: The user is successfully authorized and can proceed with using the miniapp.

​

Setting up the back end

Note: Feature must be enabled in Dashboard Partnership

​

Generate Auth Token

• This endpoint must handle a HTTPS POST request
• URL to endpoint must be provided in Dashboard

• Response status must be 200 in all cases
• Response body:

1. For new users:
   • Create a new user account with the received inputs for new users. Use reference field as identifier.
   • Ensure that the new user account is identical to the regular user accounts within your authorization system.
2. For existing users:
   • If the user already exists in your database, generate an authorization token for the user and return it.
3. Return the access token:
   • At the end of the login process, generate an authorization token.
   • The authorization token will serve as proof that the API calls made are from a specific user.
   • You can also specify the session expiry time according to your preferences.
   • You can also provide refresh_token for the session renewal without triggering connect flow again.

curl --location --request POST '[YOUR_SERVER_URL]/get_auth_token/' \
--header 'Authorization: Basic {{BASE64_ENCODED_APP_ID_AND_SECRET_KEY}}' \
--header 'Content-Type: application/json' \
--data-raw '{
	"reference": "{{HOSTAPP_USER_REFERENCE}}",
	"email": "{{USER_EMAIL}}",
	"phone": "{{USER_PHONE}}",
	"first_name": "{{USER_FIRST_NAME}}"
	"last_name": "{{USER_LAST_NAME}}"
}'

​

Authorizing users at different phases of miniapp experience

const handleLogin = async () => {
  try {
    const {
      // token string
      token
    } = await appboxo.login()
  } catch (error) {
    console.error(error)
    // Prompt authorization failure
  }
}

​

Logging out

const handleLogout = async () => {
  try {
    await appboxo.logout()
  } catch (error) {
    console.error(error)
    // Prompt logout failure
  }
}

​

Security