Trading Widget Authentication

Recommended mode: partner-token

partner-token avoids putting short tokens in URLs and keeps apiSecret on the partner backend.

const widget = TradingWidget.create('#trading-widget', {
  baseUrl: 'https://app.6mm.com',
  auth: {
    mode: 'partner-token',
    tokenProvider: async ({ channelId, symbol, reason }) => {
      const resp = await fetch('/api/trading/embed-token', {
        method: 'POST',
        credentials: 'include',
        headers: { 'Content-Type': 'application/json' },
        body: JSON.stringify({ channelId, symbol, reason }),
      })
      if (!resp.ok) {
        throw new Error('Failed to request embed token')
      }
      return resp.json()
    },
  },
})

Create Embed Token: backend token issuance example.
Trading Widget Quick Start: complete initialization flow.
Secrets & Signing: keep privileged Agent credentials on the backend.
Troubleshooting: diagnose session, token, origin, and initialization failures.

Backend flow

1. Partner frontend receives auth_request from the iframe.
2. SDK calls tokenProvider.
3. Partner frontend calls its own backend.
4. Partner backend validates the partner session.
5. Partner backend calls 6MM Agent API or Java SDK createEmbedToken.
6. SDK sends embedToken to the iframe through postMessage.
7. iframe exchanges embedToken for a 6MM access token.
8. iframe continues initialization and emits ready.

tokenProvider contract

Field	Direction	Description
channelId	SDK -> Partner backend	Unique widget session identifier. The backend should pass it to createEmbedToken.
symbol	SDK -> Partner backend	Current or initial trading symbol passed as integration context; it is not a token trading-pair permission restriction.
reason	SDK -> Partner backend	Why the SDK is requesting a token, such as initial load or refresh.
embedToken	Partner backend -> SDK	Short-lived token created by the Agent SDK or Agent API.
expireAt	Partner backend -> SDK	Token expiration timestamp returned by 6MM.

Failure handling

Condition	Recommended handling
Partner session expired	Return 401 from the partner endpoint and ask the user to sign in again.
Token creation failed temporarily	Throw an error in tokenProvider and allow the widget to surface an auth error.
channelId mismatch	Reject the request and recreate the widget instance.
User is not allowed to trade	Return a partner-controlled error and do not create an embed token.

Compatibility mode: agent-sso

agent-sso keeps the older /agent-entry ticket flow. Prefer partner-token for new integrations.

const widget = TradingWidget.create('#trading-widget', {
  baseUrl: 'https://app.6mm.com',
  auth: {
    mode: 'agent-sso',
    entryUrlProvider: async ({ redirectPath }) => {
      const resp = await fetch('/api/trading-entry', {
        method: 'POST',
        credentials: 'include',
        headers: { 'Content-Type': 'application/json' },
        body: JSON.stringify({ redirectPath }),
      })
      const data = await resp.json()
      return data.webUrl
    },
  },
})

Seconds trading and environment rules

For seconds pages, use the same partner-token authentication with page and tradingMode configured on the Widget. There is no separate prediction token. Every tokenProvider call must obtain a fresh one-time token from your backend.

Return embedToken, expireAt in Unix seconds, and the original channelId as a top-level object. The Agent SDK token response does not contain channelId; your backend echoes the current Widget channel. If your endpoint wraps responses in data, unwrap it before returning from tokenProvider.

Full seconds integration · Funds environment guide