OptionalallowOptionalappOptionalbodyOptionalbuttonsOptionalbuttonOptionaldispatcherOptionalexpiresOpener-URL lifetime in seconds; signs an exp the web app can enforce.
OptionalfetchOptionalinit: RequestInitOptionalinit: RequestInitOptionalflowOptionalfooterOptionalonOptionalopenEmit a real native in-app webview button (open_webview) instead of cta_url. Default false (cta_url renders on regular accounts; open_webview needs the in-app-webview capability).
OptionalparamsOptionalsecretHMAC-SHA256 key; when set, the opener URL's params are signed (tamper-proof).
OptionaltextOptionalthumbnailOptionalthumbnailOptionalthumbnailRemote thumbnail byte cap (default 512 KiB).
OptionalthumbnailRemote thumbnail fetch timeout (default 10s).
OptionaltitleOptionalurlOptionaluseToggle cta_url's (WA-ignored) webview_interaction flag. Default true. Kept for backward compatibility — for a REAL in-app webview use openWebview.
Allow localhost/private-IP thumbnail URLs. Off by default to reduce SSRF risk.