App screens that open inside the admin
An installed app can show its own screens in the admin. The frame is signed in with a session token that lasts a minute and is refreshed as needed, so the app never sees a password.
Apps · Rider Sync
/apps/rider-sync/embed
- session token
- signed · expires in 60 s
- bridge
- SET_TITLE · Deliveries today
Bridge messages
- Embedded in the admin with a signed session token Loaded
- The bridge asks for a fresh token Token expiring
- New session token issued, no reload TOKEN_REFRESH
In short
Embedded apps open at /apps/{app}/embed inside the admin, receiving a signed session token that expires after 60 seconds and is refreshed through the app bridge. The app can set its title, add sidebar links, open modals and resize itself through bridge messages.
The problem it solves
An app that lives on its own website makes staff log in twice and switch tabs. A long lived token copied into an iframe is a key anyone can reuse.
How it works
4 steps, start to finish
-
1
Open the app
The admin loads the app's screen in a frame with signed parameters.
-
2
It gets a session
A session token valid for 60 seconds proves who the merchant is.
-
3
It talks to the admin
Bridge messages set the title, sidebar links and modals, and navigate the host.
-
4
It stays signed in
TOKEN_REFRESH gets a fresh token while the screen is open.
In detail
What embedded screens does for you
-
Inside the admin
Your screens open next to the merchant's own.
-
Short lived tokens
60 second session tokens, signed with HMAC SHA256.
-
App bridge
READY, CONTEXT, SET_TITLE, SET_SIDEBAR_LINKS, MODAL_OPEN, RESIZE and more.
-
Refresh endpoints
Sessions refresh without sending the merchant anywhere.
-
The frame carries a signed session token for the merchant and business, which the app exchanges or verifies.
-
60 seconds. The app refreshes it through the bridge while the screen is open.
-
Only through bridge messages: its title, sidebar links, modals, navigation and its own height.
Works together with
- The install screen lists every scope an app asks for before it gets access.
- An app reads and writes only what the scopes the merchant granted allow.
- Apps contribute blocks and sections to the storefront and the page builder.
- Public documentation for building apps, plus an API reference with Postman and OpenAPI exports.
Embedded screens · Free to start
Try embedded screens on your own business
Set up in a couple of minutes. Your catalogue, orders and books stay yours to export.
- Live in 2 minutes
- Free to start
- No credit card
