Skip to main content

​
Delivery model

RaaS Widgets does not ship a partner SDK for iframe embedding. The integration model is:
  1. Mint a magic link with the Partner API
  2. Deliver data.url to the end user
  3. Let the flow host render the experience
That URL works in a mobile browser, desktop browser, or a native WebView.

​
Presentation flags

Pass presentation on create-link to tune UI gates before flow-specific screens: showAgreement is deprecated and ignored. Widgets show Welcome when the user has not accepted the current terms version (!termsAccepted).
Partner theme still loads when splash is disabled.

​
Native WebView checklist

1

Mint the link server-side

Never embed your API key in the mobile app. Your backend calls POST /partner/links and returns only the URL (and optionally expiry) to the client.
2

Load the URL

Open data.url in a full-screen WebView (SFSafariViewController / Chrome Custom Tabs / WKWebView / Android WebView). Prefer system browsers when possible for cookie and biometrics compatibility.
3

Allow navigation

Keep navigation within the flow host and known CIP/payment domains. Do not intercept or rewrite the path unless Leap documents a callback scheme for your integration.
4

Handle completion

Prefer webhooks on your backend for authoritative completion. Pass envelope callbackUrl on create-link so the widget can Return to app while the magic link is still valid (errors, cancel-leave). Cash-deposit also has config.callbackUrl for the Done / host handoff — that wins when both are set.
5

Set a return URL for dead links

In Partner Settings, set sessionExpiredRedirectUrl to an https URL your app or WebView can load. The widget uses it when the user opens an already expired or revoked magic link, not only when a session expires mid-flow. The Return to app button appears only when that URL is http or https. Do not reuse envelope callbackUrl here.
Two return URLs:
  • Live link: envelope callbackUrl (and cash-deposit config.callbackUrl when present) for Return to app / Go to app while the session is valid.
  • Dead link: sessionExpiredRedirectUrl in Partner Settings when a user opens a magic link that is already expired or revoked. The widget shows Return to app only for an http or https URL.
In a native WebView that URL must be one the host can load (an https page or an HTTPS Universal Link / App Link). Custom URL schemes and postMessage are not part of this contract. For non-WebView delivery, open the same url with:
  • Universal Links / App Links
  • SMS or email
  • An in-app “Continue” button that launches the system browser

​
Security notes

  • Treat the link URL as a bearer capability until it expires — do not log it in analytics cleartext if avoidable
  • Revoke links that should no longer be usable (POST /partner/links/{linkId}/revoke)
  • Use short TTLs for push/SMS channels

​
Next steps

Create links

Full create-link contract.

Webhooks

Completion signals.