Handshake Error

Unable to Process Inbound Handoff

Endpoint Status: Standby & Ready

Open App Bridge Receiver

This page is the active, conformant receiver endpoint for openappbridge.org. Any web application can discover this receiver at /.well-known/open-app-bridge and dispatch structured documents directly here.

🚀

Test Inbound Transfer to This Receiver

Synthesize and dispatch a conformant OAB link envelope right into this endpoint to test the preview workflow.

Endpoint Discovery Declaration

Endpoint Path /receive

Discovery URL /.well-known/open-app-bridge

Supported Transports link-envelope/1, detached-datachannel/1

Supported Media Types text/markdown, text/html, text/plain, image/*

Max Transfer Limits 24.5 KB (link) · 16 MB (detached)

Persistence Policy Ephemeral Preview Only (0 bytes stored)

Inbound Private Share

Review shared content?

External Application would like to share content directly with this browser tab over a private WebRTC peer channel.

We will verify the sender application before opening a temporary, safe in-memory preview. Nothing will be stored.

Review Shared Content

Establishing Private Peer Channel…

Negotiating secure WebRTC transfer with sender application.

link-envelope/1 Sent from: Sender App · Just now

Untitled Document

Developer Guidance

What should a production receiver implement?

If you are building an OAB receiver for your application (e.g. a markdown editor, personal notebook, or whiteboard), here is the architectural pattern recommended by the specification:

🔒

1. Explicit User Preservation

The OAB protocol strictly prohibits silent, automatic saving. A production receiver must present a transient preview and require an intentional user confirmation (e.g. "Save to Notes" or "Import Document") before committing to persistent storage.

📁

2. Destination & Scope Mapping

Allow the user to choose where the incoming content belongs (e.g. selecting a destination folder, project workspace, or tagging category). You can also provide options to merge into an active file or create a brand-new page.

🛡️

3. Sender Origin Trust Policies

For frequently paired applications, offer options like "Always accept handoffs from notes.example". The OAB policy API supports storing verified origin rules so trusted workflows feel seamless while unknown senders remain explicit.

🧼

4. Strict Content Sanitization

Always treat incoming text and markdown as untrusted external input. Sanitize HTML, parse markdown strictly without raw script execution, and maintain strict Content Security Policies with default-src 'self' and frame-ancestors 'none'.

Next steps with Open App Bridge

Integrate OAB into Your App Protocol Specification ↗ Try Live Sender Workbench