{"_id":"@authentify2026/consent-widget","name":"@authentify2026/consent-widget","dist-tags":{"latest":"0.1.0"},"versions":{"0.1.0":{"name":"@authentify2026/consent-widget","version":"0.1.0","description":"Embeddable React consent widget for agent authorization","main":"dist/index.js","types":"dist/index.d.ts","scripts":{"build":"tsc","dev":"tsc --watch","prepublishOnly":"npm run build"},"keywords":["authentify","consent","authorization","agent","widget"],"author":{"name":"iCOA Labs"},"license":"MIT","peerDependencies":{"react":"^16.8.0 || ^17.0.0 || ^18.0.0","react-dom":"^16.8.0 || ^17.0.0 || ^18.0.0"},"devDependencies":{"typescript":"^5.0.0","react":"^18.0.0","react-dom":"^18.0.0","@types/react":"^18.0.0","@types/react-dom":"^18.0.0"},"gitHead":"4b17fd2a251556be8671f797161e93b7ff4e5f78","_id":"@authentify2026/consent-widget@0.1.0","_nodeVersion":"24.18.0","_npmVersion":"11.16.0","dist":{"integrity":"sha512-K8QFEM91hEm5O+wyxfRp7hKi5kvtCEo/ZkiEjUo6QK5MazIZIiyrq0SiEOfkUfaDUDKS0z9dF/2LzRGGPya+pw==","shasum":"fa44ad0760daf5347de7be2ce549ee02a67a8662","tarball":"https://registry.npmjs.org/@authentify2026/consent-widget/-/consent-widget-0.1.0.tgz","fileCount":62,"unpackedSize":110424,"signatures":[{"keyid":"SHA256:DhQ8wR5APBvFHLF/+Tc+AYvPOdTpcIDqOhxsBHRwC7U","sig":"MEQCIEZYQqWyqijOmB8eGKD1odVj6oVwwjjYfkh/g6dm5A6+AiAjhtlsO7UYbWEUUfgx/XlSf/mJuyCfoVL2h3PgBj8iHQ=="}]},"_npmUser":{"name":"authentify2027","email":"rmcmillan925@gmail.com"},"directories":{},"maintainers":[{"name":"authentify2027","email":"rmcmillan925@gmail.com"}],"_npmOperationalInternal":{"host":"s3://npm-registry-packages-npm-production","tmp":"tmp/consent-widget_0.1.0_1786470132233_0.8843131118788468"},"_hasShrinkwrap":false}},"time":{"created":"2026-08-11T17:42:12.019Z","0.1.0":"2026-08-11T17:42:12.420Z","modified":"2026-08-11T17:42:12.696Z"},"maintainers":[{"name":"authentify2027","email":"rmcmillan925@gmail.com"}],"description":"Embeddable React consent widget for agent authorization","keywords":["authentify","consent","authorization","agent","widget"],"author":{"name":"iCOA Labs"},"license":"MIT","readme":"# @authentify/consent-widget\r\n\r\nEmbeddable consent widget for agent authorization — the customer-facing UI a\r\nfinancial institution embeds (as a cross-origin iframe pointed at\r\n`widget.authentify.bz`) so their end-users can authorize an AI agent to act\r\non their behalf.\r\n\r\nThis package is the React implementation that runs *inside* that hosted\r\niframe page. It is not published directly into a bank's own bundle — the\r\niframe boundary is what keeps Authentify's auth-sensitive UI isolated from\r\nthe host app's JS context.\r\n\r\n## Flow\r\n\r\n1. **Disclosure** — what the agent will do, its scope, and the issuing\r\n institution. Continue or decline.\r\n2. **Authenticate** — no in-widget credential entry. The widget does a full\r\n top-level redirect to the institution's own auth domain\r\n (`config.institution.authRedirectUrl`); the institution runs its real\r\n biometric/OTP challenge and redirects back to `returnUrl`. Authentify\r\n never touches credentials or biometric data, and the session only\r\n advances past this step once the institution confirms success\r\n server-to-server (not via a trusted redirect query param).\r\n3. **Consent / Review** — final scope, rate limit, and expiration. Decline\r\n or authorize.\r\n4. **Confirmation** — success, expiration date, and an optional \"Manage\r\n access\" link.\r\n5. **Revocation** — a separate screen (`ConsentManager`), not part of the\r\n iframe flow above: a list of the end-user's connected agents with a\r\n revoke action per agent.\r\n\r\n## Usage\r\n\r\n```tsx\r\nimport { ConsentWidget } from '@authentify/consent-widget';\r\n\r\nfunction ConsentPage({ sessionId }: { sessionId: string }) {\r\n return (\r\n {\r\n // result.consentToken — hand off to the institution per their\r\n // own integration (e.g. postMessage to the parent frame). The\r\n // authoritative record already exists server-side; this is a\r\n // convenience signal only.\r\n }}\r\n onDeclined={() => {\r\n /* close the iframe / notify the host app */\r\n }}\r\n />\r\n );\r\n}\r\n```\r\n\r\n```tsx\r\nimport { ConsentManager } from '@authentify/consent-widget';\r\n\r\nfunction ManageAgentsPage({ customerToken }: { customerToken: string }) {\r\n return ;\r\n}\r\n```\r\n\r\n`sessionId` comes from the `widget_url` an institution's backend receives\r\nfrom `POST /consent-sessions` (server-to-server, per\r\n`authentify_widget_architecture.md`). `customerToken` is the token issued\r\nalongside `consent_token` when an end-user first authorizes an agent — it\r\nscopes the revocation list to that end-user, not a dashboard `customer_id`\r\nor API key.\r\n\r\n## Theming\r\n\r\nPresentation (surface, auth method, and full white-label theme tokens) is\r\nper-institution config, fetched from the session config endpoint at load —\r\nnot build-time or hardcoded here. See `ConsentSessionConfig` in `src/types.ts`.\r\n\r\n## API assumptions\r\n\r\n`authentify_widget_architecture.md` specifies `POST /consent-sessions`,\r\n`POST /consent/authorize`, `GET /customer/consents`, and\r\n`DELETE /customer/consents/:id`, but not how the widget itself reads a\r\nsession's disclosure details and institution theme, or how a decline is\r\nrecorded. This package assumes, and calls out in `src/api.ts`:\r\n\r\n- `GET /consent-sessions/:sessionId` — returns `ConsentSessionConfig`\r\n (disclosure/consent copy, theme, surface, auth method, redirect URL).\r\n- `POST /consent/authorize` with `customer_approval: false` — records a\r\n decline, reusing the authorize endpoint's request shape.\r\n\r\nConfirm these against the actual backend implementation once it exists.\r\n\r\n## Development\r\n\r\n```\r\nnpm install\r\nnpm run build # tsc -> dist/\r\nnpm run dev # tsc --watch\r\n```\r\n","readmeFilename":"README.md","_rev":"1-7ccedec7f20fcac866b9995f1810de93"}