Delivery model
RaaS Widgets does not ship a partner SDK for iframe embedding. The integration model is:- Mint a magic link with the Partner API
- Deliver
data.urlto the end user - Let the flow host render the experience
Presentation flags
Passpresentation on create-link to tune UI gates before flow-specific screens:
Native WebView checklist
1
Mint the link server-side
Never embed your API key in the mobile app. Your backend calls
POST /partner/links and returns only the URL (and optionally expiry) to the client.2
Load the URL
Open
data.url in a full-screen WebView (SFSafariViewController / Chrome Custom Tabs / WKWebView / Android WebView). Prefer system browsers when possible for cookie and biometrics compatibility.3
Allow navigation
Keep navigation within the flow host and known CIP/payment domains. Do not intercept or rewrite the path unless Leap documents a callback scheme for your integration.
4
Handle completion
Prefer webhooks on your backend for authoritative completion. Optionally watch for a partner
callbackUrl / redirect if your flow config supports returning to your app.Deep links and in-app buttons
For non-WebView delivery, open the sameurl with:
- Universal Links / App Links
- SMS or email
- An in-app “Continue” button that launches the system browser
Security notes
- Treat the link URL as a bearer capability until it expires — do not log it in analytics cleartext if avoidable
- Revoke links that should no longer be usable (
POST /partner/links/{linkId}/revoke) - Use short TTLs for push/SMS channels
Next steps
Create links
Full create-link contract.
Webhooks
Completion signals.