Browsers and mobile apps
Check features and report usage from a web or mobile app with a customer token, never a secret key.
Your app can call Entitler itself to hide what a customer can't use and report their usage as it happens. It uses a customer token, which acts for that one customer, minted by your server.
1. Mint tokens on your server
Add a route to your server that signs the user in, as your other routes do, and mints a token for them:
app.post('/api/entitler-token', requireUser, async (request, response) => {
const { token } = await entitler.customer(request.user.id).token({
scopes: ['entitlements:read', 'usage:write'],
})
response.json({ token })
})Ask only for the scopes the app needs. Add usage:write only when the app reports usage, and billing:self only when it changes the customer's own plan.
2. Call Entitler from the app
The SDKs fetch a token from your route when they have none, and again when Entitler refuses the one they have.
import { EntitlerClient } from '@entitlerhq/entitler'
const entitler = new EntitlerClient({
token: async ({ signal }) => {
const response = await fetch('/api/entitler-token', { method: 'POST', signal, credentials: 'include' })
return (await response.json()).token
},
})
const check = await entitler.me.check('priority_support')A customer token names its customer as me, so the app never needs their external ID.
What an app can call
With the right scopes, a customer token can:
- check features and list entitlements;
- report usage, and place, read, settle and release holds;
- read the customer's usage;
- list the plans they can choose, choose or cancel a plan, and open the billing portal, with
billing:self.
Everything else needs a secret key on your server, such as giving grants, registering customers, or putting a customer on a plan they didn't choose.
Keep decisions that matter on your server
A customer controls their own device, so treat checks in an app as a way to shape the interface. Check again on your server before anything that costs you money or exposes data, such as running a paid job or returning a report.
Without a server of your own
If your app signs users in with an identity provider that issues signed identity tokens, it can use a publishable key and the user's identity token instead of a customer token; see Publishable keys and identity tokens.