Custom pages

Your app can add a page to the customer’s sidebar. You host it on your own domain; we render it in a sandboxed iframe. That is the difference between an app and a link that throws the customer out to another website.

Register a custom_page_url (https only, and not a 360Nook host). We load it with a short-lived frame_token in the query string:

GET https://your-app.com/page?frame_token=eyJhcHBJZ...

That token is not an API credential — it says only which app, which sub-account and which user, and it expires in five minutes. It travels in a URL, and URLs end up in browser history and Referer headers. Your server trades it for a real token by adding your client secret, which only you have:

curl -X POST https://app.360nook.com/api/apps/exchange \
  -H "Content-Type: application/json" \
  -d '{
    "frame_token": "<from the query string>",
    "client_id": "<your app>",
    "client_secret": "<your secret>"
  }'

# -> { "access_token": "nook_at_...", "expires_in": 3600,
#      "scope": "contacts:read", "sub_account_id": "..." }

A leaked frame URL is therefore worth nothing on its own. The exchange also checks the customer still has your app installed, so an uninstall stops it immediately rather than leaving a five-minute window.

The frame gets allow-scripts allow-forms allow-same-origin allow-popups — no top-navigation, so your page cannot replace the customer’s tab. To talk to the parent, postMessage from your registered origin; anything from another origin is dropped. One message is understood today:

parent.postMessage({ type: "nook:resize", height: 1200 }, "*")