Host Protocol
The messages a paywall exchanges with whoever is showing it — the SDK on a device, the studio locally, the dashboard in a browser — and what each side promises.
A paywall is a web page that talks to a host over postMessage. On a device the host is the native SDK. In superwall dev and in the dashboard it's the studio. The paywall cannot tell them apart, and that is the point: nothing about previewing is compiled into a published paywall.
You don't write any of this by hand — superwall/hooks and superwall/navigation speak it for you. Read this page when you're debugging what a paywall asked for, or building something that hosts one.
The envelope
Every message travels JSON-stringified in the same envelope, in both directions:
{
"version": 1,
"direction": "from_paywall",
"payload": { "events": [{ "event_name": "purchase", "product": "primary" }] }
}direction is from_paywall for what the paywall sends and to_paywall for what the host answers. Batches are normal — one envelope carries several events.
The wire is trusted for forward compatibility: a message a paywall has never heard of reaches it anyway rather than taking the whole batch down. Old app binaries with old SDKs load new paywall bundles indefinitely, so the contract is additive — messages are added, never repurposed.
The handshake
The paywall sends ping once, as soon as its runtime boots. The host replies with everything a first paint needs, in one batch:
| Reply | Carries |
|---|---|
template_variables | device, user and placement params, plus every product's variables |
products | the product list, keyed by reference |
experiment | experiment, variant and campaign ids |
template_substitutions_prefix | freeTrial when the shopper is eligible for an introductory offer, otherwise nothing |
paywall_open | the paywall is now visible — this is the presentation signal |
Because that ping is sent once and never repeated, the host has to be listening before the paywall's document loads — the studio attaches to an iframe on mount, before its content window has booted, for exactly this reason. A host that attaches after the ping never hears it, and the paywall waits forever with no variables.
See Lifecycle & Events for why paywall_open, not mount, is what entry animations gate on.
What the paywall asks for, and what comes back
| The paywall sends | The host does | The paywall hears |
|---|---|---|
purchase | buys through the store, or asks you in the studio | transaction_start, then transaction_complete (+ freeTrial_start), transaction_abandon or transaction_fail |
restore | restores purchases | restore_start, then transaction_restore + restore_complete, or restore_fail |
close | dismisses the paywall | paywall_close |
open_url, open_url_external, open_deep_link | opens it in an in-app browser, the OS browser, the payment sheet, or as a deep link | — |
request_permission | prompts the OS | permission_result |
request_callback | runs your app's registered handler | callback_result |
custom, custom_placement | hands the payload to your app | — |
user_attribute_updated | merges the attributes into the user variables it serves | — |
schedule_notification | schedules a local notification | — |
initiate_web_checkout, stripe_checkout_* | drives web checkout | see Web Checkout |
A host answers what it can and ignores the rest — an unrecognised request is dropped, never fatal.
Several replies are deliberately payload-free. restore_fail carries no reason, so "nothing to restore" and a store error are one outcome to a paywall — the SDK composes an explanation for the first case but sends it to its own logs, not over the wire. transaction_restore likewise names no product. Anything a paywall renders has to come from a message that actually carries it.
Variables arrive as patches, not snapshots
After the handshake the host sends only what changed. Switching the studio's theme sends one template_variables carrying the new interfaceStyle, not the whole bag again. That is why a paywall must guard every read rather than assume a variable is present: on a device the SDK can still deliver a product's price after first paint.
const { annual } = useProducts();
const price = annual?.variables.price ?? "";Hosting a paywall yourself
@superwall/host is the SDK's half, packaged:
import {
createHostState,
createWindowHost,
diffHostState,
silentDelegate,
} from "@superwall/host";
const { host, detach } = createWindowHost({
target: iframe.contentWindow,
state: createHostState({ paywallId: "208540", paywallIdentifier: "pro", products }),
delegate: silentDelegate(),
});
host.update(diffHostState(previous, next));The delegate decides every outcome a device would decide — purchase, restore, permission, callback — which is exactly what the studio turns into the prompts you answer. diffHostState produces the patch; the host applies it with mergeHostState, and a round-trip test in that package keeps the two honest.
In React, @superwall/studio ships that wiring as one component:
import { HostedIframe, silentDelegate } from "@superwall/studio";
<HostedIframe hostState={hostState} delegate={silentDelegate()} src={url} />;It attaches on mount — before the iframe's document has booted, which is what makes the single ping land — and sends every later hostState change as a patch. The dashboard's paywall previews are built on it, so a preview and a device now answer the runtime identically.
A host that isn't a device shouldn't answer like one. The dashboard's preview delegate returns abandoned for a purchase and ignores openUrl: it has to answer, or the paywall's button spins forever, but it must not report a transaction that never happened or navigate the page hosting it.
How is this guide?
Lifecycle & Events
What a paywall knows and when, the preload rule that shapes every entry animation, and the SDK events you can react to.
The Studio
Preview every paywall locally with superwall dev: devices, themes, locales, live variables, and purchase, restore, permission and callback outcomes you choose.