WAM Guide

This document is maintained with the Channel App SDK. Check the SDK README first for current packages and the complete reading order. The source of truth for this Document is the GitHub source.

A WAM (Web App Module) is a React web UI opened inside a Channel client. It is not an app server and does not store server credentials. Use it for Extension actions that need user interaction, such as commands, widgets, and custom tabs.

The Channel client opens a WAM when a Function returns an action result like this:

appId is public and name selects the WAM route. Browser code can read wamArgs, so never put secrets, tokens, provider credentials, or raw customer content in it.

Register the WAM root in the developer portal and serve the built SPA from ${WAM_ENDPOINT}/${name}.

Wrap the React root with WamProvider.

Go apps use the same TypeScript/React WAM package. The Go server returns the WAM action and exposes Functions while mounting the static SPA route separately.

Read host-injected values with useWamData or useTypedWamData. Depending on the surface, values may include appId, channelId, managerId, chatId, chatType, rootMessageId, and wamArgs. Do not assume optional values exist; validate them with a schema.

A WAM uses manager/user authorization managed by the Channel host. Never pass the App Secret, Signing Key, app token, or channel token through the WAM bundle or runtime data.

Use useCallFunction for app business logic and work performed as the app or bot. The server can obtain a channel token through TokenManager and perform the required operation.

Use useNativeFunction only for a Channel operation explicitly performed by the current manager or user. The host authorizes it from the current Channel surface and role; the server's TokenManager cannot mint that authorization.

Use only Native Function names and input types exported by the SDK, and enable the required permissions.

Use useWamSize for the initial size and content-driven resizing, and useWamClose to close the surface.

If closing should follow another action, await useCallFunction or useNativeFunction first and then call close(). Do not close the WAM before the user can see a failed action.

• Open the WAM from an installed private app and verify that the host bridge is available.

• Handle a browser opened directly at the WAM URL, where no host bridge exists.

• Test missing optional context, invalid wamArgs, and Function errors.

• Test manager/user permission denial separately from the server-side channel-token flow.

• Verify initial size, dynamic resizing, and normal close behavior.

• Check bundles, source maps, logs, and wamArgs for credentials.

Read the Command guide for opening a WAM from a command, the Extension guide for registration, and the production readiness guide before launch. Use the TypeScript WAM reference for exact hook APIs and the Go WAM reference for server integration.