Munchable Uses URL Fragments to Pass Login Sessions Between Website and App

Munchable runs a marketing site and a separate Expo app on different origins, so a user who signs up on the website would otherwise have to log in again in the app. The team fixed this with a short handoff function that places the session tokens in the URL fragment after the hash. Because fragments are never sent to servers, the refresh token stays out of access logs, error reports, and referrer headers. If the session has expired, the function returns false and sends the user back to sign in on the current origin. The receiving app reads the fragment first and falls back to the query string to handle OAuth returns.