0Bit Documentation

Integrate mobile WebViews

Use the hosted 0Gate redirect flow inside mobile WebViews without putting secret credentials or settlement decisions in the app.

Use mobile WebViews when your native app needs to open the hosted 0Gate flow without building a native checkout surface. The mobile app starts from your backend, opens a hosted checkout page, listens for your return or cancel URL, and reads final status from your server.

The mobile app is not the settlement system

Keep secret keys, webhook secrets, session creation, reconciliation, and fulfillment on your backend. The app can display status and route users, but it should never decide that value moved.

Mobile flow

LayerResponsibility
Native appStarts checkout, opens WebView or system browser, intercepts your own return/cancel URLs, shows status.
Your backendCreates attempts, creates 0Gate sessions, stores session ids, verifies webhooks, exposes status.
0Gate hosted flowRuns customer-facing KYC, quote, payment, confirmation, and terminal hosted UX.
Outcome pageReads trusted state from your backend and renders processing, success, failure, expired, or cancelled.

Start from a web handoff page

The safest mobile pattern is to open a page you control, then let that page call the browser SDK redirect. This keeps hosted URL generation and browser behavior consistent with your web integration.

import { GateRamp } from '@0bit/gate/browser';

export function startMobileCheckout(clientSecret: string) {
  GateRamp.redirectToCheckout({
    publishableKey: import.meta.env.VITE_GATE_PUBLISHABLE_KEY,
    clientSecret,
    environment: 'sandbox',
    theme: 'light',
  });
}

Your mobile app opens that handoff page in a WebView or system browser after your backend has created the attempt and session.

Intercept only your own URLs

When navigation reaches your return_url or cancel_url, close or replace the WebView and show a status page backed by your API.

func webView(_ webView: WKWebView,
             decidePolicyFor navigationAction: WKNavigationAction,
             decisionHandler: @escaping (WKNavigationActionPolicy) -> Void) {
  guard let url = navigationAction.request.url else {
    decisionHandler(.allow)
    return
  }

  if url.host == "app.example.com", url.path.starts(with: "/checkout/") {
    showCheckoutStatus(url)
    decisionHandler(.cancel)
    return
  }

  decisionHandler(.allow)
}
override fun shouldOverrideUrlLoading(view: WebView, request: WebResourceRequest): Boolean {
  val uri = request.url
  if (uri.host == "app.example.com" && uri.path?.startsWith("/checkout/") == true) {
    showCheckoutStatus(uri)
    return true
  }
  return false
}

WebView checklist

CheckGuidance
JavaScriptRequired for the hosted checkout page and browser handoff page.
External browser fallbackOffer it if the WebView blocks payments, wallet links, or required browser capabilities.
Allowed originsRegister exact origins used by return and cancel pages.
Status refreshPoll or subscribe to your own attempt status, not 0Gate browser callbacks.
RetryCreate a fresh attempt/session for expired sessions.
PrivacyDo not log full URLs if they contain browser session values.

Customer states

StateMobile UI
requires_actionOpen hosted checkout.
processingClose WebView and show “confirming” status.
fulfilledShow receipt or next product step.
failedShow safe failure copy and retry/support.
expiredCreate a new session before retry.
cancelledReturn to the previous screen with a retry option.

Do not

  • Put sk_* credentials, webhook secrets, or provider credentials in the app.
  • Scrape hosted iframe DOM or inject code into the 0Gate flow.
  • Fulfill, credit, ship, or release value from a WebView navigation event.
  • Surface raw provider, compliance, treasury, or internal diagnostic details to customers.

On this page