Secure app launch

POST/api/v1/app/launch/exchange

Dashboard adds a 60-second, single-use launch_code to a manifest-allowed target URL. Dashboard cookies and JWTs are never sent to the external app.

Exchange from your backend

Exchange the code from your app backend and establish your own session from the returned installation, actor, scopes and resource context.

cURLJavaScriptPython

REQUEST

curl --request POST
  --url https://stage-integration.tica.tr/api/v1/app/launch/exchange
  --header 'Authorization: Bearer <APP_KEY>'
  --data '{"code":"launch_..."}'

Response

BodyHeaderscURL

JSON OUTPUT

{"installation_id":"install_...","domain_id":42,"scopes":["orders.read"]}