Auth & Encryption SDKs

The forex card and remittance web apps each needed login and PAN verification, and requests had to be end-to-end encrypted.

• An OTP login SDK: one AuthModal() call mounts the login in any host app. Used by the forex card and remittance web apps.
• A PAN verification SDK: format check, consent-based name fetch, an 18+ check and attempt limits, in one openPanModal() call.
• Fixes to the encrypted HTTP SDK: empty encrypted responses no longer throw, decrypted error bodies reach callers, and npm advisories went from 24 to 0 at v1.2.0.
• A telemetry SDK with AES via WebCrypto, hand-written RSA key wrapping, gRPC-Web framing and an IndexedDB offline queue.
• An email-verification page that scores Lighthouse 97 Performance and 100 Accessibility on Slow 4G.

The backend moved sessions to HttpOnly cookies with rotating refresh tokens, where reusing a refresh token revokes the session, so two tabs refreshing at once could log the user out. I made refresh single-flight inside a tab and serialised it across tabs with the Web Locks API, with a safe fallback when locks aren't available, and kept the SDK's public API exactly the same.

Both apps moved to cookie sessions with an 11-point migration checklist. Tokens are now held in memory, not in script-readable storage.