Skip to content

Production release of Cross-Platform Communication #32

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Open
MatejHamala wants to merge 1 commit into
base: gh-pages
Choose a base branch
from
Open

Production release of Cross-Platform Communication #32

Changes from all commits
Commits
Show all changes
1 commit
Select commit
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
7 changes: 2 additions & 5 deletions _posts/2026-02-20-cross-platform-communication.md
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -7,9 +7,6 @@ active_item: ""
order: 7
---

{: .message}
**Planned — not yet implemented:** This document describes future API changes that are designed but not yet available. It is published early to allow app (extension) developers to validate the proposed design and to begin preparation before the feature is officially released.

This document describes how communication between apps (extensions), external applications, and Mergado is intended to work once the new cross-platform communication layer is in place. Everything builds on top of the existing Mergado API authorization model — no new authorization system is introduced.

Four communication scenarios are supported:
Expand Down Expand Up @@ -51,7 +48,7 @@ Field | Description
`entity_id` | ID of the entity making the request (user, shop, or project ID).
`entity_type` | Type of the entity: `user`, `shop`, or `project`.
`scopes` | Intersection of the caller's OAuth scopes and the target app's registered scopes.
`expires_at` | Expiration timestamp — approximately **5 minutes** from the time of issue.
`exp` | Expiration timestamp — approximately **5 minutes** from the time of issue.

{: .message}
**Important:** JWT tokens are **not refreshable**. Each proxied request receives its own fresh token valid for ~5 minutes. Once expired, the token cannot be used and a new request must be made.
Expand All @@ -60,7 +57,7 @@ Field | Description

When your app receives a proxied request, it **must verify the JWT token** before processing the request:

1. **Check expiration** — reject tokens where `expires_at` is in the past.
1. **Check expiration** — reject tokens where `exp` is in the past.
2. **Verify the signature** — validate that the token was issued by Mergado using the public key available at the [JWKS endpoint](https://api-docs.mergado.com/?api=mergado-api#/.well-known/jwks.json):

```
Expand Down