Embed SDK (widgets)
Embeddable MeerPartners influencer-cabinet widgets: dashboard, links, network, payouts — inside your product via a scoped token from token-exchange. The concept and its link to SSO.
The Embed SDK is a way to embed the influencer cabinet right into your product: the user sees their affiliate statistics, links and payouts without leaving for the MeerPartners portal. The widgets run on a short scoped token that you obtain through token-exchange.
Status and implementation details
The concept of embed widgets and the affiliate:embed scoped token are already supported on the API side. The concrete SDK delivery (the npm package name, the exact component names and initialization parameters) may still be refined — follow the up-to-date instructions the platform operator provides together with access. Below is the concept and the contract the SDK relies on, without invented package details.
The idea
Instead of taking the user to a separate affiliate-program site and forcing a sign-in, you:
- exchange the user identifier for a scoped token on your backend;
- pass the token to the frontend;
- initialize the widget — it calls the affiliate API with this token by itself.
The user stays in your interface and under your account — no second registration needed.
Which widgets
The widgets correspond to the sections of the influencer cabinet:
| Widget | What it shows |
|---|---|
| Dashboard | The partner's summary metrics: clicks, conversions, revenue |
| Links | The partner's tracking links and their creation |
| Network | The partner's multi-level referral structure |
| Payouts | Balance, withdrawal requests and history |
Access scope = the token's scope
The widgets are limited by the rights of the affiliate:embed scoped token. This is the influencer cabinet of a specific user — not an admin panel and not the business cabinet. "Dangerous" actions (signing out of all sessions, role onboarding) are unavailable to an embed token.
Link to token-exchange
All widget access hinges on the scoped token from token-exchange. The flow:
Your frontend Your backend MeerPartners
│ show the widget │ │
│ ────────────────────► │ POST /api/v1/auth/token-exchange
│ │ (HMAC, scope sso) │
│ │ ────────────────────────►│
│ │ ◄── access (affiliate:embed) │
│ ◄── scoped token ─────│ expires_in: 600 │
│ │ │
│ init the widget with the token ───────────────────► affiliate APIThe minimal practical integration scenario:
Get the token on the backend
Call token-exchange with your subject_token and an API key with the sso scope. The response carries access_token (scope: "affiliate:embed", TTL 10 minutes), refresh_token, affiliate_id and tenant_id.
Pass the token to the frontend
Hand access_token to your frontend over a secure channel. The API key secret is not passed to the frontend — only the ready scoped token.
Initialize the widget
Pass the token to the SDK when initializing the widget you need. From there the widget calls the affiliate API on behalf of the user by itself.
Refresh the session
The access token is short-lived (10 minutes). Use refresh_token to extend it via POST /api/v1/auth/refresh, or repeat the token-exchange.
Never issue a scoped token from the browser
Token-exchange is signed with the API key secret, and so it runs on the backend only. Only the short-lived scoped token reaches the frontend. If you issue tokens straight from the browser, the key secret will leak.