# Baziness pages & their messages

> The web pages your game shows inside itself — sign-in, profile, the reward shop and your game's offer page — the parameters each one needs, and the messages they send back.

## What the pages are
Some parts of Baziness are **web pages** that your game shows **inside itself**, for example the sign-in screen and the «انتخاب جایزه» reward shop. You open a page's URL in an in-game web view: an `iframe` on the web, a WebView component in an engine. The page talks back to your game with **messages**, for example "the player signed in" or "close me".

All the pages are hosted on one site:

| Environment | Pages base `{web}` |
| --- | --- |
| Development | `https://platform-web-dev.karizmastudios.org` |
| Production | `https://baziness.com` |

How to build the in-game view (a sheet that slides up and is swiped down to close) is in [Bottom sheet / web view](bottom-sheet.md).

## Parameters
> [!IMPORTANT]
> `linkedToken` is being replaced by `linkCode`, a one-time code from your server (`v2/client/link-code/{userId}`). Pages accept both during the migration. See [Token migration](token-migration.md#platform-link-code).

| Parameter | When | Value | Why |
| --- | --- | --- | --- |
| `packageName` | **always** | your platform package name | identifies your game |
| `sdkType` | **always** | `js` | tells the page it is inside a game, so it sends you messages. Without it, even the page's close button can't close your view |
| `linkedToken` | whenever you have one | the player's **user token** | the page acts as **this** player, and a sign-in on the page is bound to them |
| `redirect` | profile, rewards | `profile` / `shop` | where the page returns after a sign-in inside it |
| `allowGuest` | sign-in, profile, game offer | `false` | hides the page's own "continue as guest"; your game already offers that choice |
| `game_name` | rewards, game offer | your game name, URL-encoded | selects your game's prizes and offer |
| `buildStore` | store builds only | `CafeBazaar` / `Myket` | the page hides links to the other stores |

Encode every value, because `game_name` may be Persian and tokens may contain `+` or `/`.

## The pages
| Page | Path | Open it when | Parameters |
| --- | --- | --- | --- |
| **Sign-in** | `/` | the player taps «ورود با حساب بازینس», or must sign in to claim a reward | `packageName`, `sdkType=js`, `linkedToken`, `allowGuest=false` |
| **Profile** | `/profile` | Settings → connect or manage the account | `packageName`, `sdkType=js`, `linkedToken`, `redirect=profile`, `allowGuest=false` |
| **Reward shop «انتخاب جایزه»** | `/shop` | the player taps your reward button | `game_name`, `packageName`, `sdkType=js`, `linkedToken`, `redirect=shop`. **No** `allowGuest` |
| **Game offer** | `/game-offer` | once, during your tutorial ([details](game-offer.md)) | `game_name`, `packageName`, `sdkType=js`, `linkedToken`, `allowGuest=false` |

```text
Login        https://baziness.com/?packageName=com.karizmastudio.example&sdkType=js&linkedToken=eyJ…&allowGuest=false
Profile      https://baziness.com/profile?packageName=com.karizmastudio.example&sdkType=js&linkedToken=eyJ…&redirect=profile&allowGuest=false
Rewards      https://baziness.com/shop?game_name=example&packageName=com.karizmastudio.example&sdkType=js&linkedToken=eyJ…&redirect=shop
Game offer   https://baziness.com/game-offer?game_name=example&packageName=com.karizmastudio.example&sdkType=js&linkedToken=eyJ…&allowGuest=false
```

> [!IMPORTANT]
> For the reward shop, open **`/shop`**. Don't open the site root (`/`): the root sends a player inside a game to the sign-in screen, while `/shop` uses the token the player already has.

## Messages from the pages
A page sends messages with `postMessage`. Each message is JSON, as a string or an object, in the form `{ "type": "...", "data": ... }`:

| `type` | `data` | Meaning | What your game does |
| --- | --- | --- | --- |
| `close` | — | the page's close button was pressed | close the view |
| `login` | a token: `"<token>"` or `{ "token": "<token>" }` | the player signed in to an account | send the token to **your server**, which [verifies it](platform-api.md#step-4-verify-a-token-from-the-client) and links the account or switches to the player's other account; then refresh the token and close the view |
| `login` | *(none)* | the player's current account was linked in place | mark the player as linked, refresh the token |
| `token` | a token | a silent handshake the page sends when it loads | **ignore it**: it is not a sign-in |
| `logout` | — | the player signed out inside the page | close the view, delete everything your game stored locally, and start again as a brand-new visitor |

> [!WARNING]
> - Only accept messages whose origin is the page you opened (`{web}`), and ignore everything else.
> - Never treat `token` as a sign-in. If you do, the reward shop closes as soon as it opens.