In-App Shopping
In-App Shopping lets your customers shop on any supported merchant website inside your own mobile app — and pay with a Visa/Mastercard virtual card number (VCN) issued by Open Fabric, without ever seeing or typing card details.
Your app opens the merchant in a WebView hosted by the Open Fabric In-App Shopping SDK. The SDK detects the checkout page, extracts the order (items, total, shipping details), and hands it to your app. You show your own payment approval UI. Once your customer approves and your backend creates the transaction, the SDK fills the merchant's card form with the VCN automatically — the card fields are hidden from the customer throughout.
Actors and components
| Component | Owned by | Role |
|---|---|---|
| Your App | You | Your mobile application. Embeds the In-App Shopping SDK, owns the payment approval UX. |
| Your Backend | You | Your backend service. Holds your Open Fabric OAuth credentials; creates shopping sessions and transactions. |
| In-App Shopping SDK | Open Fabric | Android library (co.openfabric:of-in-app-shopping-sdk). Hosts the merchant WebView, captures checkout pages, runs the payment automation. |
| Open Fabric In-App Shopping service | Open Fabric | Analyzes checkout pages and extracts order details. Never touches card data. |
| Open Fabric Issuer service | Open Fabric | Issues the VCN and returns it — encrypted — directly to the SDK. |
End-to-end flow
Security model
The SDK holds no OAuth token, API key, or other long-lived credential. Your backend creates each session and receives a single-use exchange token (60-second TTL) that the SDK redeems for a session-scoped token. A compromised device can, at worst, act on one shopping session for its limited lifetime — it cannot create transactions or fetch cards for other sessions.
Card details never transit the In-App Shopping analysis service. The SDK fetches the VCN directly from the Open Fabric Issuer service, encrypted with an RSA-2048 key generated on the device at session start (RSA-OAEP with SHA-256). Decryption happens on-device only; the card number is filled into hidden form fields and is never displayed, logged, or stored.
Checkout pages captured for order extraction are sanitized on the device before upload — scripts are stripped and sensitive input values (card numbers, CVV, passwords) are redacted. All SDK traffic uses certificate-pinned TLS.
Non-blocking guarantee
Payment automation never traps your customer. If any step fails — a selector no longer matches, the merchant changed their checkout — the SDK restores the merchant's own payment form and reports the failure to your app. The customer can always complete the purchase with the merchant's native payment methods.
Prerequisites
- Open Fabric API credentials for your backend — see Authentication.
- Access to the In-App Shopping SDK package (provided by Open Fabric during onboarding).
- The merchants you want to enable, onboarded by Open Fabric for you.
Integration steps
- Set up the SDK — add the Android dependency and initialize it.
- Create a shopping session — mint an exchange token from your backend and start the WebView session.
- Capture and approve the order — receive the extracted order, show your approval UI, create the transaction.
- Run the payment — hand the card fetch token to the SDK and handle the outcome.