Skip to main content

SSO/session handoff between Custom Integration and Embedded Storefront

Feature Request

Hi Moonbase team,

we use the Custom Integration storefront mode. Customers authenticate through our server-side PHP integration using the Storefront API, and the access and refresh tokens remain securely stored in the PHP session.

When we open the Embedded Storefront checkout, the browser widget does not recognize the existing customer session and asks for the customer details again.

Is there a documented and supported server-to-browser session handoff or SSO mechanism for the Embedded Storefront? For example:

  • a short-lived one-time token

  • a signed session-exchange endpoint

  • or another supported way to initialize the widget with an already authenticated customer

We do not want to expose access or refresh tokens in the HTML or manually write the widget’s internal moonbase_authlocalStorage entry.

What is the recommended architecture for sharing authentication between a server-rendered custom storefront and the Embedded Storefront checkout?

Cheers,
Marc

Posted by Marc Wensauer ·
2 comments

Log in to comment and vote

Comments2

  • Marc Wensauer

    •

    Jul 5

    Update / clarification:

    The customer association itself is working correctly with the server-side order creation flow.

    However, we are still running into a UX issue with the Embedded Checkout iframe.

    Because the checkout is rendered inside the embedded Moonbase frame, it is difficult to make it fit naturally into our own page layout. The iframe height, scrolling behavior and surrounding spacing are hard to control reliably, especially across different screen sizes.

    In practice, this can lead to:

    • an iframe with its own scrollbar;

    • awkward empty space;

    • clipped checkout content;

    • broken or uncomfortable mobile scrolling;

    • a layout that feels visually disconnected from the rest of the storefront.

    We can style the surrounding container, but we cannot control the internal Moonbase content or dynamically adapt the iframe cleanly from our side.

    So while the server-side order creation solves the customer/session association for checkout, the embedded presentation itself still feels difficult to integrate well.

    Is there a recommended full-page checkout flow using the returned checkout URL, or a supported way for the iframe to automatically resize to its content height?

    Cheers,
    Marc

  • Marc Wensauer

    •

    Jul 5

    Resolved on our side.

    We kept the Embedded Checkout, but changed how the order is created.

    Instead of calling Moonbase.purchase() directly in the browser, our PHP backend now:

    1. creates a new UUIDv4 for the order,

    2. sends the order server-side via the Storefront API,

    3. includes the authenticated customer access token in the Authorization header,

    4. requests checkout with checkout=true,

    5. receives the embeddedCheckoutUrl,

    6. opens that URL in the existing checkout overlay.

    This keeps access and refresh tokens entirely in the PHP session and avoids any browser-side token handoff or localStorageworkaround.

    The checkout is now correctly associated with the logged-in customer, and customer data such as email, name, and country is prefilled.

    So for a server-rendered custom storefront, the recommended solution appears to be creating the order server-side with the customer access token, then opening the returned embeddedCheckoutUrl.

    Cheers,
    Marc