Managed Space runtime bridge and commerce

The server injects arinova:ready; Space author code must not send it. The parent verifies the exact iframe window, fragment-bound bridgeToken, and protocolVersion: 1, then sends arinova:auth with user profile, scopes, a short-lived OAuth access token, optional agents, and expiry. Keep that token in memory only. A Space can send arinova:request-scope for a declared agents or economy scope. Approval produces a refreshed auth message; denial produces arinova:scope-denied and should be treated as a normal non-fatal outcome.

In-app charging uses arinova:purchase-request, never a direct debit call. The host loads the authoritative catalog, shows native confirmation, sends the session-authenticated purchase with the current expected price and idempotency key, and replies with arinova:purchase-result. Results are purchased, cancelled, or error. Runtime OAuth endpoints list products and inventory and atomically consume quantities; durable ownership and subscription state stay on the server.

Deactivating a subscription product stops new sales but does not end existing renewals. A separate wind-down action stops sales, sets live subscriptions to cancel at period end, and notifies subscribers. Existing subscription prices are snapshots; editing a catalog price affects new subscribers only. Paid-funded commerce credits 70% to creator earnings, while bonus-funded points do not. Administrative refunds and subscription clawbacks reverse attributable earnings.

Related actions

arinova.web.search

Also known as

Space bridge, arinova auth message, request Space scope, Space in-app purchase, Space inventory, Space product subscription, Space creator revenue

---

Machine-readable Markdown · Knowledge index