app-sdk
SDK for building custom apps registered with Zesty.io
Authentication
When the zesty.io manager-ui mounts a custom application it uses postMessage to communicate between the host(manager-ui) and guest app(your custom application). Once your application triggers the "load" event listener the manager-ui will send a message containing the users session token. The SDK will then hold on to that token and make all SDK.request function calls with an Authentication Bearer token header.
Security
Custom applications are ran within a iframe inside of the manager-ui. This creates a JavaScript execution boundary between the two applications. Preventing guest application code from affecting the host and vica-versa. Communication between the isolated code envrionments is accomplished with postMessage