Block Client API

When using Blocks API, Block Client is a client-size callback API that allows you to handle certain events related to blocks.

This API operates cross-origin via postMessage, and identifies blocks by their instance parameters that you specify.

Your client-side code implementing Block Client API could be as simple as:

const Callbacks = {
  Resize1: function({ instance, height }) {
    let iframe = document.getElementById(instance)
    if (iframe) {
      iframe.style.height = ev.data.height + 'px'
    }
  },
  ApplyDiscountCode1: function({ code }) {
    ...
  },
}
window.addEventListener('message', function(ev) {
  if (ev.data.bubblehouseBlockClientCall) {
    Callbacks[ev.data.bubblehouseBlockClientCall](ev.data)
  }
}, false)

Returning values

This is a one-way API: currently there's no provision to return a response.

Authentication & Security

None; this is all happening within a page, so the customer is already authenticated.

Note, however, that any iframe on your page can fake a Block Client API call, including untrusted code like ads. Right now there's no sensitive functionality exposed through this API, so there's no security risk involved. If we ever add a function that allows spending customer's money, we'll need to introduce extra authentication.