Hosted Connect.
One-tap consumer-permissioned sharing: the consumer approves exactly what you see, in their own Vault. You get a public_token, never the file.
Live · consumer-owned
Integration
import { SwippeeConnect } from "react-swippee-connect";
<SwippeeConnect
mode="hosted"
createRequest={createConnectRequest} // your server: POST /v1/connect/request
onHostedSuccess={(r) => exchange(r.publicToken)}
/>