Secure expandable advertisements using an api and cross-domain communications

A method comprising:

• receiving, by a client device from a content publishing system, webpage data of a webpage in which the webpage data references a rich media advertisement hosted on a third party system that has a different domain than the content publishing system, the webpage data also including a security token that corresponds to the rich media advertisement and the third party system;
• communicating, by the client device based on the webpage data referencing the rich media advertisement, a data request to the third party system, the data request including a request for advertisement data of the rich media advertisement;
• receiving, by the client device from the third party system, the advertisement data as a response to the data request;
• presenting, by the client device, the webpage with the rich media advertisement using the webpage data and the advertisement data;
• communicating, by the client device to the third party system, a notification of occurrence of a triggering event that occurs at the client device with respect to the rich media advertisement;
• receiving, by the client device from the content publishing system in response to communicating the notification, an action instruction to perform an action with respect to the rich media advertisement, the action instruction being received in response to the content publishing system authenticating a call received by the content publishing system from the third party system in which the call includes the action instruction and the security token and is authenticated based on the security token corresponding to the rich media advertisement and the third party system;
• and
• performing, by the client device based on the action instruction, the action with respect to the rich media advertisement.

A system comprising:

• one or more processors;
• and
• one or more machine-readable storage media having instructions stored thereon that, in response to being executed by the one or more processors, cause the system to perform operations comprising:
• communicating, to a client device by a content publishing system, webpage data of a webpage in which the webpage data references a rich media advertisement hosted on a third party system that has a different domain than the content publishing system, the webpage data also including a security token that corresponds to the rich media advertisement and the third party system;
• receiving, by the content publishing system from the third party system, an application program interface (API) call that includes the security token and an action instruction regarding performance of an action with respect to the rich media advertisement;
• authenticating, by the content publishing system, the third party system as being authorized to provide instructions regarding the rich media advertisement via the API call based on verifying that the security token corresponds to the rich media advertisement and the third party system;
• and
• communicating, from the content publishing system to the client device, the action instruction such that the client device performs the action with respect to the rich media advertisement.

One or more non-transitory machine-readable storage media having instructions stored thereon that, in response to being executed by one or more processors of a system, cause the system to perform operations comprising:

• receiving, by a third party system from a client device based on webpage data received by the client device from a content publishing system, a data request for advertisement data of a rich media advertisement referenced by the webpage data, the data request including a security token that is included in the webpage data received by the client device;
• associating the security token with the rich media advertisement in response to the security token being included in the data request;
• and
• communicating, to the content publishing system from the third party system, an application program interface (API) call that includes the security token and an action instruction regarding performance of an action with respect to the rich media advertisement such that the content publishing system authenticates the third party system as being authorized to provide instructions regarding the rich media advertisement via the API call based on verifying that the security token corresponds to the rich media advertisement and the third party system, the API call including the security token based on the API call being related to the rich media advertisement and based on the security token being associated with the rich media advertisement.