A native app ships the channel's publishable key in its binary, which is what publishable means, and keeps its Live session by a session token the app stores. The rest is the website flow over HTTPS.
A native app has no same-origin story, so the publishable key ships in the
app binary. That is what publishable means: it identifies one channel and
grants nothing beyond the low-trust surface. The app talks to
Live over HTTPS and the sequence is the one on
A buyer on your website.
The credential. The publishable key (tlpk_, low trust) is in the
app and on every request to Live; the channel is the key's. Session
state lives in the Live session, keyed by a session token the app stores
and sends as X-Live-Session. The customer token, once the buyer has
signed in, is kept in that Live session and escalates it; the app never
holds a customer token of its own.
GET /sales/listings to Live under the publishable key.
tlpk_, in the app; the channel is the key's
Make an order
The first cart creates a Live session; the app stores the session token and sends it as X-Live-Session. POST /sales/carts, items, checkout, then POST /sales/orders/{id}/payments.
tlpk_ plus the session token
Authenticate a customer
POST /sales/customer-auth/magic-link, the buyer types the 15 minute code into the app, POST /sales/customer-tokens with { type: "magic_link", code }. Live stores the customer token in the session.
tlpk_ authenticates; the customer token is carried on top
Read the order back
GET /sales/my-orders under the escalated session, or GET /sales/orders/{id} where the session holds the order access token.
It can be extracted, and that is fine. Anyone who reads it out of the
app can do exactly what the app can do: list what the channel sells, open
a cart, start a checkout and, with a buyer's own magic link code, see that
buyer's orders. It reaches the low-trust surface only, whose responses are
declared views.
It cannot reach anything administrative. Cost, allocation, other
customers, other channels and every write to the catalogue are on the
high-trust surface, which a publishable key cannot authenticate to.
The session token is not a credential either. It names a Live session.
Losing it loses a cart; it does not grant anything the key did not.
The queue gate and the rate limiter sit in front of Live for an app exactly
as for a browser, so a gated on-sale is one implementation for both.