Waiting for sign-in from host
Open this app inside ImpactStudio. The host must send a token from an allowed origin before any app data can be shown.
How it works
ImpactStudio sends a token by postMessage from an allowed origin. The app keeps it only in memory and sends it as an Authorization bearer header to its backend. The backend checks the token on every /api route except the public GET /api/health. On a 401, the app asks the host for a new token, waits up to 10 seconds, and retries once.
The current backend validator is a mock: it decodes JWT claims and checks expiry but does not verify signatures. Fake test tokens are disabled unless ALLOW_FAKE_TOKENS is explicitly set to true. Nothing is saved to browser storage or a database.