Innovade SDK

Appearance

State & Security ​

The Platform SDK is built with casino-grade security protocols in mind.

API Key & Domain Whitelisting ​

Every request made by the SDK automatically includes an x-platform-key header containing your API Key.

Domain Whitelisting: Because frontend applications are inherently public, your backend must verify the Origin header of incoming requests. If someone steals your API Key and tries to use it from evil.com, your backend will reject the request via CORS policies.

Token Management Strategy ​

The SDK uses a dual-token system to secure user sessions:

  1. Access Token: Short-lived (e.g., 15 minutes). Stored in SDK memory. Used to authorize all /v1/ API requests.
  2. Refresh Token: Long-lived (e.g., 7 days). Stored in localStorage. Used exclusively to fetch new Access Tokens.

This mitigates XSS (Cross-Site Scripting) attacks. If an attacker steals the access token from memory, it expires in 15 minutes. They cannot steal the refresh token from memory.

401 Auto-Retry Interceptor ​

If a user leaves their tab open for 20 minutes, the Access Token will expire.

When they return and click a button, the SDK will:

  1. Attempt the API request.
  2. Receive a 401 Unauthorized response.
  3. Silently pause the request, call /v1/auth/refresh using the Refresh Token.
  4. Save the new Access Token.
  5. Retry the original API request.

This entire process happens in the background. The frontend user experiences zero interruptions.