Issued: 16th September 2026 | TB-1639
- Release version:
2.0.8 - SDK URL:
https://app-sdk.token.io/2.0.8/token.min.js - Audience: Partners integrating Token's embedded SDK for HPv2 (widget/iframe/modal flows)
- Type: Reliability fix (recommended upgrade)
This SDK release improves the reliability of the bank connection pop-up window during the payment/consent flow. Previously, in some browser configurations, the pop-up used to redirect the PSU (Payment Service User) to their bank could be incorrectly blocked as an unwanted pop-up
- Reduces PSU drop-off caused by browsers silently blocking the bank redirect window.
- No integration changes required - this is a drop-in SDK update.
- Particularly relevant for partners embedding the flow in a modal or iframe (most web integrations).
app-sdk (token.min.js) is the client-side JavaScript SDK that partners embed in their web or mobile-web checkout/consent journey to run Token's open banking flows - single immediate payments, future-dated payments, VRP, and AIS consent. It renders Token's Hosted Pages inside the partner's page (typically as a modal or iframe) and handles the PSU-facing steps: bank selection, handoff to the bank's own authentication page, and returning the result (success, failure, cancellation) back to the partner's integration. Because bank authentication pages cannot be rendered inside an iframe (banks block this for security reasons), app-sdk is responsible for breaking the flow out of the embedded modal/iframe into a separate, top-level browser window once the PSU selects their bank - the change this release addresses.
- Since bank authentication pages cannot be opened inside an iframe, the SDK must break out of the embedded modal/iframe context into a separate browser window once the PSU selects their bank.
- Previously, this window was opened asynchronously after the bank selection, which meant it could fall outside the browser's "user gesture" window - the short time frame during which browsers trust a pop-up as user-initiated rather than blocking it.
- In v
2.0.8, the window is now opened synchronously, immediately on the PSU's click, ensuring it stays within the trusted user-gesture context and is not blocked by the browser's pop-up policy.
Background on browser user-gesture restrictions and async code: https://discourse.wicg.io/t/user-gesture-restrictions-and-async-code/1640/
- Update the SDK reference to
2.0.8(or later) in your integration. - No API or configuration changes needed.
Contact your implementation manager or support@token.io with any questions.