Test your app on the web

How it works

On a phone, Casa Tookan injects its providers — window.ethereum, the Bitcoin providers, window.unisat, window.webXCP, window.casaTookan — into your page's WebView. A browser cannot inject a script into a page of another origin, so devapp opens your app in an iframe, and a small script your page loads, the bridge, asks devapp for those providers over postMessage. Every call then goes through Casa Tookan's approval sheets, and signatures are made by its web signer.

What to add

1. The bridge, first thing in <head>Before your own scripts, so it runs before them. It loads casa-tookan-web.js from devapp only when devapp is the page framing yours.

   <script>
     (function () {
       if (window.parent === window || window.ReactNativeWebView) return;
       var o = (location.ancestorOrigins && location.ancestorOrigins[0]) || '';
       if (!o && document.referrer) try { o = new URL(document.referrer).origin; } catch (e) {}
       if (o === 'https://devapp.casatookan.com')
         document.write('<script src="' + o + '/casa-tookan-web.js"><\/script>');
     })();
   </script>

   A page with a strict Content-Security-Policy needs https://devapp.casatookan.com in script-src, and 'unsafe-eval' while devapp frames it.
2. Your manifest, readable from devappdevapp reads /.well-known/wallet-app.json (or casatookan.json) from its own origin: serve it with Access-Control-Allow-Origin: * — it is public. Without it the browser blocks the read, Casa Tookan sees no declared capability and refuses casaTookan.ceid and tookans calls. A phone applies no CORS: this only shows on the web. Best: give every /.well-known/ answer that header, the 404s included, so devapp can tell a file you don't serve from a network failure (it assumes a missing file when the browser is online).
3. Let devapp frame youContent-Security-Policy: frame-ancestors 'self' https://devapp.casatookan.com on your pages: devapp may frame them, other sites may not. A page sent with X-Frame-Options or a stricter frame-ancestors stays blank in devapp.
4. Keep your session when framedFramed by devapp, your page is a third party: a SameSite=Lax cookie is not sent, and your server answers 401 right after a sign-in that worked. Over https, set it SameSite=None; Secure; Partitioned — partitioned, the cookie is kept per top-level site, so a session opened in devapp is not the one a player has elsewhere, and browsers that block third-party cookies still keep it.
   Then refuse the requests another site sends with it: a POST whose Sec-Fetch-Site is neither same-origin nor none, or one that is not application/json (another site cannot send JSON without a CORS preflight you never grant).

For Ethereum, keep listening for Casa Tookan's announcement — in devapp it arrives a few milliseconds after your scripts; in the phone it answers your request:

let casaEthereum = null;
window.addEventListener('eip6963:announceProvider', (e) => {
  if (e.detail?.info?.rdns === 'com.everdreamsoft.casatookan') casaEthereum = e.detail.provider;
});
window.dispatchEvent(new Event('eip6963:requestProvider'));
const ethereum = () => casaEthereum ?? window.ethereum;   // at the moment you call it

Then open devapp, create a test wallet, and type your app's URL in Browse. A page without the bridge shows a notice with the line to add.

Your app on localhost

Serve your app on http://localhost and open that URL in devapp: browsers treat localhost as a secure origin, so an https page may frame it, and your page loads the bridge from devapp like any other. Chrome may ask devapp for access to your local network the first time: accept it. On http://localhost, Chrome accepts Secure cookies too.

Safety

Limits

No in-app purchases of Tookans, no WalletConnect pairing by camera, no App Attest or Play Integrity: those are phone features. Back and forward follow what the bridge reports.