owner auth

owner auth lets your widget know that the visitor is the site owner. this is how official widgets do things like posting statuses from the site itself.

authorizeOwner

on call WidgetStar opens a popup, the owner confirms, you get a token. send that token to your server and verify it there. never trust it on the client!

const WS = createWS();

btn.onclick = async () => {
    const token = await WS.authorizeOwner();
    await WS.fetch('/api/do-something', {
        method: 'POST',
        headers: { 'Content-Type': 'application/json' },
        body: JSON.stringify({ token }),
    });
};

on the server:

const res = await fetch('https://widget.st/api/verify-owner', {
    method: 'POST',
    headers: { 'Content-Type': 'application/json' },
    body: JSON.stringify({ token }),
});
if (!res.ok) {
    // invalid / expired
}
const data = await res.json();
// data.instance_id, data.widget_id, data.user_id

authorizeOwner() reuses an existing token when it can. if the popup is blocked or the owner cancels, it throws.

getOwnerToken

WS.getOwnerToken() returns the stored token, or null, without popup.

username and email

by default you only get instance_id, widget_id, user_id. if you also need username and email:

const token = await WS.authorizeOwner({ requestUserData: true });

they'll see an extra prompt, and /api/verify-owner will include username and email.