@tribe/app-bridge

SDK for Tribe Mini Apps — the postMessage bridge between a mini-app iframe and the Tribe host shell.

npm install @tribe/app-bridge

Quick start

import { bridge } from '@tribe/app-bridge';

// Handshake with Tribe host — resolves once the host is ready to
// receive further messages.
await bridge.send('TribeAppInit');

// Who's using the mini app (no server round-trip — data comes from
// the signed launch params).
const me = await bridge.send('TribeAppGetUserInfo');
console.log(`Hi, ${me.firstName}!`);

// Grab the raw signed launch params. Mini-app backends use this to
// verify identity (the signature is HMAC-SHA256 over a canonical
// query string keyed on the app's own secret).
const { rawQuery } = await bridge.send('TribeAppGetLaunchParams');

// Call your OWN backend directly — not through Tribe. Pass the
// signed params as a header; your backend verifies the signature
// and extracts `tribe_user_id`.
const res = await fetch('https://my-mini-app.example.com/contacts', {
  headers: { 'X-Tribe-Signed-Params': rawQuery },
});

Methods

| Method | Description | |---|---| | TribeAppInit | Handshake with the Tribe host. Call this first. | | TribeAppClose | Close the mini app, return to Tribe. | | TribeAppGetLaunchParams | Raw signed launch-params query string. | | TribeAppGetUserInfo | Current Tribe user (from signed launch params). | | TribeAppRequestScopes | Prompt the user for scope consent (VK-style modal). | | TribeAppOpenProfile | Navigate to a Tribe user profile. | | TribeAppOpenDirectMessage | Open Tribe's DM drawer with a user / prefilled text. | | TribeAppOpenLink | Open an external https URL in a new tab. | | TribeAppShowAlert | Native alert modal rendered by the host. | | TribeAppShowConfirm | Native confirm modal rendered by the host. | | TribeAppResize | Adjust iframe height. |

Authentication model

Mini apps bring their own backend. Tribe signs launch params with a per-app HMAC secret (stored in Tribe's mini_apps.secret_key); the mini-app backend holds the same secret and verifies the signature on every request. Tribe's API gateway is not in the data path between the mini-app frontend and its backend.

License

UNLICENSED — internal to Tribe until further notice.