Mobile Feed (ZYKAY App)

The v4 loader automatically manages mobile and desktop flows.

Behavior v4

  • Mobile: “Open ZYKAY” button (deep link / universal link)
  • Desktop: QR code to scan from the mobile app
  • Return success: redirection to data-success-path#grant_code=...

Minimal integration

<script src="https://widget-app.zykay.com/v4/loader.min.js"
        data-partner-id="pk_live_xxx"
        data-success-path="/verified"
        data-scopes="isAdult"></script>

No endpoint /launch or URL /frame is required in v4.

Return processing

const hash = new URLSearchParams(window.location.hash.slice(1));
const grantCode = hash.get('grant_code');
if (grantCode) {
  await fetch('/api/zykay/exchange', {
    method: 'POST',
    headers: { 'Content-Type': 'application/json' },
    body: JSON.stringify({ grant_code: grantCode }),
  });
}

Server-verify mode (optional)

If you want to wait for a backend confirmation before unlocking UI:

<script src="https://widget-app.zykay.com/v4/loader.min.js"
        data-partner-id="pk_live_xxx"
        data-success-path="/verified"
        data-server-verify="true"
        data-server-verify-endpoint="/api/zykay/server-verify"
        data-server-verify-timeout="30"></script>

Complete contract (events, expected endpoint, timeout): Mode Server-Verify

Common problems

  1. The app does not open:
  • check installation of the ZYKAY app
  • check that the link is not blocked by an internal browser
  1. The user returns but nothing happens:
  • check reading of grant_code in window.location.hash
  • check backend call /api/zykay/exchange
  1. Return with query ?grant_code=:
  • still tolerated temporarily, but migrate to the #grant_code= fragment

The URL fragment avoids the propagation of grant_code in Referer headers.