iframe
and transaction approvals occur in a pop-up window.iframe
and opening Identity in a new window via window.open
. The iframe
context can handle transaction signing and message decryption. The window.open
context can handle log in, sign up, log out, and account management. Both iframe
and window.open
contexts communicate with the parent via window.postMessage
.id
and method
are requests that expect a response.id
and no method
are responses to requests.id
do not expect a response.id
format.initialize
initialize
. This message is sent in both iframe
and window.open
contexts. A response is required so Identity knows the hostname of the parent window.window.open
contextaccessLevelRequest
as a query parameter when opening the Identity window. If no accessLevelRequest
is specified then ApproveAll
is used as the default.login
login
message is sent. The login message does not expect a response and means the Identity window can be closed by calling window.close
on the stored reference to the window.open.publicKey
will be included in publicKeyAdded
. When a user approves a transaction the signed transaction will be included in signedTransactionHex
.publicKey
and users
objects in its local storage. When an application wants to sign or decrypt something the accessLevel
, accessLevelHmac
, and encryptedSeedHex
values will be required.iframe
contextinfo
info
messages which helps Identity support Safari and Chrome on iOS. Apple's Intelligent Tracking Prevention (ITP) places strict limitations on cross-domain data storage and access. This means the Identity iframe
must request storage access every time the page reloads. When a user visits a BitClout application in Safari they will see a "Tap anywhere to unlock your wallet" prompt which is a giant button in the iframe
. When the info
message returns hasStorageAccess: false
, an application should make the iframe
take over the entire page. Above, this means setting requestingStorageAccess = true
.info
message also detects if a user has disabled third party cookies. Third party cookies are required for Identity to securely sign transactions. If info
returns browserSupported: false
an application should inform the user they will not be able to use Identity to sign or decrypt anything.storageGranted
iframe
sends a storageGranted
message when a user clicks "Tap anywhere to unlock your wallet." It does not expect a response. When an application receives this message it can hide the iframe
from view and the iframe
is now ready to receive sign
and decrypt
messages.sign
window.open
to acquire a signedTransactionHex
.decrypt
jwt
jwt
message creates signed JWT tokens that can be used to verify a user's ownership of a specific public key.?webview=true