Re: [w3c/webpayments-payment-apps-api] Thoughts on the current spec (#34)

> For the Web-based payment app case, please say more about how the user consents to register the payment app.

There're several options available to us. From the top of my head, one method is to gate payment app Service Worker registration on [user activation](https://html.spec.whatwg.org/multipage/interaction.html#triggered-by-user-activation). So the user must click an `[Install BobPay]` button for `register()` call to succeed.

```js
// Payment app is a Service Worker, but register() can be triggered only by a user activation.
navigator.paymentApp.register('/sw.js').then(function(registration) {
  console.log(registration);
}).catch(function(error) {
  console.log(error);
});
```

> When the merchant recommend an app and the user chooses it, this could be the action that registers the app.

Sure, I can see this happening.

1.  Merchant recommends `https://bobpay.xyz` payment app.
1. Browser fetches icon, label, and the location of the Service Worker from `https://bobpay.xyz/payment-manifest.json`.
1. User selects BobPay from for payment.
1. Browser installs the Service Worker `https://bobpay.xyz/sw.js` and immediately triggers its `onpaymentrequest` event.

> Do you think we need to provide any information (e.g., a transaction identifier) that
could be used to query the state of a transaction?

This would fit well into your "good practices" document as optional advise. Some payment apps might need this, but others may not.

-- 
You are receiving this because you are subscribed to this thread.
Reply to this email directly or view it on GitHub:
https://github.com/w3c/webpayments-payment-apps-api/issues/34#issuecomment-245431139