YouLend Embedded Components

A TypeScript/JavaScript library for embedding YouLend's application journey into your web application.

How It Works

This NPM package provides TypeScript support and dynamically loads the YlEmbed.js script from YouLend's CDN.

The NPM package loads a release-specific CDN script for its own package version and pins that script with Subresource Integrity. If you prefer, you can also load the Embedded Components script directly from our CDN.

Runtime Compatibility

The published package supports Node.js 14.21.3 or later and npm 6.14.18 or later. This requirement applies when installing, bundling, or server-side rendering the package; the embedded journey itself runs in the browser.

Quick Start

For more detailed examples and docs, visit the embedded components docs.

import { loadYlEmbed, YlEmbedOptions, ApplicationJourney } from 'ylembed-js';

const options: YlEmbedOptions = {
  partnerName: 'your-partner-name',
  country: 'GB', // 'US' | 'GB' | 'DE' | 'FR' | 'PL' | 'NL' | 'BE' | 'ES' | 'IE'
  environment: 'sandbox', // 'production' | 'sandbox'
  thirdPartyCustomerId: 'your-unique-id-for-the-logged-in-user',
  createEmbedToken: async () => { // Create embed token for the logged in merchant
    const response = await fetch('/yourapi/yl-embed-token', { method: 'POST' });
    const { accessToken } = await response.json();
    return accessToken;
  }
};

const ylEmbed = await loadYlEmbed(options);
const journey: ApplicationJourney = ylEmbed.create('ApplicationJourney');
journey.open();

Available Types: YlEmbedOptions, ApplicationJourneyOptions, ApplicationJourney, YlEmbed

Direct CDN Usage

For strict version pinning, load a release-specific script URL:

<script
  src="https://sdk.youlend.com/releases/{version}/ylembed.js"
  integrity="sha384-{release-hash}"
  crossorigin="anonymous"
></script>

The release hash is published alongside the release asset at /releases/{version}/ylembed.sri.txt and in /releases/{version}/manifest.json.

For backwards-compatible latest-v1 loading, you can use:

<script src="https://sdk.youlend.com/v1/ylembed.js"></script>

The /v1/ylembed.js URL is a mutable latest-v1 alias and may receive backwards-compatible fixes without changing the URL.

Versioning

Each NPM package version loads the matching release-specific CDN script. For example, NPM package version x.y.z loads https://sdk.youlend.com/releases/x.y.z/ylembed.js and pins the expected script bytes using Subresource Integrity.

Major-version CDN aliases, such as https://sdk.youlend.com/v1/ylembed.js, remain available for direct integrations that prefer a latest-compatible script URL.

Changelog

1.0.4

• Added backwards compatibility with Node.js 14.21.3 and npm 6.14.18.

1.0.3

• Introduced immutable, release-specific CDN script URLs.
• Added Subresource Integrity (SRI) checks so browsers can verify that the loaded script matches the package release.

Content Security Policy

If you implement a CSP, please ensure you allow the following:

• Scripts (script-src) from https://sdk.youlend.com
• Iframes (frame-src):
  • Production: https://youlend.com (and/or https://youlend.us if supporting USA)
  • Sandbox: https://partners.staging-youlend.com (and/or https://uspartners.staging-youlend.com if supporting USA)

Documentation

Full Documentation API Reference

License

ISC (c) YouLend