Embedding

You open the Shop with a path-based referral link: the provider slug is the first path segment. Routing between iframe and WebView views is decided automatically once the session is established.

Entry URL

https://<shop-host>/<slug>[/<sale_channel>][?uid=<id>&ts=<unix>&sign=<hmac>][&lang=vi|en]

Component	Required	Notes
`slug`	yes	Your provider slug, issued by Bluecom. Replaces the old `?partnerCode=`.
`sale_channel`	no	Path segment #2 — pins a sale channel. Omit → default channel.
`uid` + `ts` + `sign`	no	Signed identity trio. Present → SSO; absent → guest. See Authentication.
`lang`	no	`vi` (default) or `en`. Overrides locale.

Only open the entry link (/<slug>/...); the Shop router.replaces to an inner route after minting the session. Deep-linking straight to an inner route is not supported.

iframe (desktop web)

<iframe
  src="https://<shop-host>/acme-bank/acme-default"
  width="100%"
  height="800"
  allow="payment; clipboard-write"
  style="border: 0;"
></iframe>

An iframe link is unsigned (guest) — no uid/ts/sign needed; the user signs in inside the Shop if required. Your production domain(s) must be in Bluecom's CSP frame-ancestors allowlist (submitted during onboarding).

Native WebView

iOS (Swift / WKWebView)

let url = URL(string: shopUrl)! // from your backend
let config = WKWebViewConfiguration()
config.websiteDataStore = .default() // cookies persist
let webView = WKWebView(frame: view.bounds, configuration: config)
webView.load(URLRequest(url: url))

Android (Kotlin / WebView)

webView.settings.javaScriptEnabled = true
webView.settings.domStorageEnabled = true
CookieManager.getInstance().setAcceptThirdPartyCookies(webView, true)
webView.loadUrl(shopUrl) // from your backend

Requirements

JavaScript and DOM storage enabled.
Cookies enabled; the WebView must accept sameSite=none; secure; partitioned.
HTTPS in production.

Telegram Mini App

For partners building a Telegram Bot Mini App:

Open the Shop as the Mini App URL with the /<slug> path — the HMAC signature (uid/ts/sign) is not used.
The Shop reads window.Telegram.WebApp.initData (Telegram's signed payload) as the auth credential instead of HMAC.
The Mini App start_param carries the partner code as a fallback; the path slug only identifies the provider.
All other sections (theming, session, tracking, payment return) apply unchanged.

Coordinate with Bluecom ops to register your bot domain and enable initData verification.

KBZPay In-App H5

For KBZPay partners, the Shop opens at /<slug>?kbzpay_token=<credential> and uses kbzpay_token as the auth credential — not HMAC. It enters as a guest, then establishes identity via KBZPay's credential.

Embedding

On this page