@tesouro/embedded-components-widget-token 0.7.40 → 0.7.43

package/README.md

@@ -59,42 +59,18 @@ const { widgetToken, exp } = await mintWidgetToken({
 });
 ```
 
-### Next.js Route Handler
+### In a route handler
 
-```ts
-// app/api/widget-token/route.ts
-import { NextRequest, NextResponse } from 'next/server';
-import { configureCreateWidgetToken } from '@tesouro/embedded-components-widget-token';
-
-const mintWidgetToken = configureCreateWidgetToken({
-  clientId: process.env.TESOURO_CLIENT_ID!,
-  clientSecret: process.env.TESOURO_CLIENT_SECRET!,
-  widgetSecret: process.env.TESOURO_WIDGET_SECRET!,
-  organizationReference: process.env.TESOURO_ORGANIZATION_REFERENCE!,
-});
-
-export async function POST(req: NextRequest) {
-  // Resolve the user from YOUR authenticated session — NEVER from the request
-  // body. This route hands back a valid widget token for whatever identity you
-  // pass in, so reading `userId` / `userEmail` from `req.json()` would let any
-  // caller mint a token impersonating someone else. Swap `getSession` for your
-  // own server-side session verification (signed cookie, bearer token, etc.).
-  const session = await getSession(req);
-  if (!session) {
-    return NextResponse.json({ error: 'Unauthorized' }, { status: 401 });
-  }
-
-  const { widgetToken, exp } = await mintWidgetToken({
-    userId: session.userId,
-    userEmail: session.userEmail,
-  });
-  return NextResponse.json({ widgetToken, exp });
-}
-```
+Call the factory from an authenticated route on your server and return
+`{ widgetToken, exp }` to the browser.
+[Getting started](https://components.tesouro.com/components/getting-started)
+has a complete Next.js route handler and the provider that calls it.
 
 > **Identity must come from the server, not the caller.** Resolve `userId`,
-> `userEmail`, and `organizationReference` from your authenticated session and
-> partner config — never from the request body. This endpoint mints a valid
+> `userEmail`, and `organizationReference` from your authenticated session,
+> never from the request body. `organizationReference` names the business the
+> user belongs to, so bind it once in `configureCreateWidgetToken` only when
+> every user of that server belongs to the same business. Your route mints a valid
 > token for whatever identity it receives, so trusting client-supplied identity
 > lets any caller impersonate another user.
 
@@ -156,6 +132,12 @@ The encrypted payload is an RFC 8693 token-exchange request whose
 is minted at the outer encrypted payload level as `organization_reference`; it
 is not added to the inner `subject_token`.
 
+Backends that don't run Node build the same token from the widget token
+protocol in Authentication › User token, in the
+[Embedded Banking](https://docs.tesouro.com/embedded-banking/guides/authentication/user-token)
+or [FinOps](https://docs.tesouro.com/finops/guides/authentication/user-token)
+docs.
+
 ## License
 
 Apache-2.0

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@tesouro/embedded-components-widget-token",
-  "version": "0.7.40",
+  "version": "0.7.43",
   "license": "Apache-2.0",
   "type": "module",
   "repository": {