Skip to main content
Load a fixed version of the Bridge script and verify it with Subresource Integrity (SRI). Use version pinning when your security policy requires review of third-party script updates.
Truv recommends the default https://cdn.truv.com/bridge.js without a pinned version. It always serves the latest version, so you get fixes without changing your code. A pinned version requires you to update it within 6 months of its release.
Pin the version in a <script> tag or with the @truv/bridge and @truv/react packages.

​
Get the latest version

Every Bridge release publishes a manifest. Fetch the manifest of the latest release:
The manifest contains everything you need for the script tag:
Each version also keeps its own manifest at https://cdn.truv.com/bridge/vX.X.X/manifest.json.

​
Add the script

Copy url and integrity from the manifest into the script tag:
Always set crossorigin="anonymous" together with integrity, or the browser blocks the script. Never set integrity on https://cdn.truv.com/bridge.js: that URL serves the latest version, so its hash changes with every release.
Then call TruvBridge.init() as usual. See Embedded Orders or Widget-only.

​
Use the npm packages

Version pinning requires @truv/bridge 2.3.0 or later, or @truv/react 2.4.0 or later.
@truv/bridge and @truv/react load the latest Bridge script as soon as you import them. To pin a version, import from @truv/bridge/lazy or @truv/react/lazy instead. Then pass source: 'cdn' with version and integrity from the manifest to load():
init() and the React components wait until you call load(). Call it as early as possible, for example on app start. Only the first load() call takes effect. See the package documentation on npm for the React example and the full API.
Never import @truv/bridge or @truv/react without /lazy in the same app. That import loads the latest version, and your pinned version and integrity are ignored.

​
Use your own script tag

With source: 'cdn', the package inserts the Bridge script into the page at runtime. If your Content Security Policy or another restriction blocks dynamically inserted scripts, add the script tag to your HTML yourself. Then pass source: 'window' to load(). The package uses window.TruvBridge from your script tag and never loads the script itself:
Place the script tag without async before your app’s script. window.TruvBridge must exist when you call init() or when a React component opens Bridge. Otherwise, Bridge doesn’t open and logs an error to the browser console.

​
Update a pinned version

Update to a newer version within 6 months of the pinned version’s releasedAt date. The period starts at release, not when you pin the version.
1

Get the latest version

Fetch https://cdn.truv.com/bridge/latest.json.
2

Update your code

Replace src and integrity in the script tag, or version and integrity in the load() call. With source: 'window', update only the script tag.
3

Test in sandbox

Create a bridge token on your backend with your sandbox API keys. Open Bridge with that token before you deploy to production.
Pinning locks the version of the Bridge script running on your page. The verification flow that Bridge opens is served by Truv and always runs the latest version.