Step-by-step guides for every framework and language — from your first embed to production-grade token verification. Start with the quick walkthrough or jump straight to your stack.
Understand the architecture and get your first embed running.
Add a complete, hosted authentication UI to any web app with an iframe and a few lines of JavaScript — then verify tokens on your server.
3 min readThe architecture behind embedded authentication — the iframe boundary, postMessage handshake, RS256 tokens, and why third-party cookies never enter the picture.
3 min readDrop the embed into React, Next.js, Vue, and other frameworks.
Mount the EmbedAuth iframe in a React app with a reusable component and a custom hook that handles the postMessage lifecycle and cleanup.
1 min readEmbed authentication in a Next.js App Router project — a client component for the iframe and a Route Handler that verifies the token and sets a first-party session cookie.
1 min readAdd the EmbedAuth iframe to a Vue 3 app with a Composition-API component that manages the postMessage listener and auto-resizes the frame.
1 min readVerify RS256 JWTs on your server in any language.
Validate EmbedAuth's RS256 tokens on a Node.js backend using jose — with a reusable verifier, Express middleware, and the checks you must never skip.
2 min readValidate EmbedAuth's RS256 tokens in Python using PyJWT and its JWKS client, with a reusable verifier and ready-to-use Flask and Django examples.
1 min readValidate EmbedAuth's RS256 tokens in Go using the golang-jwt and keyfunc libraries, with a cached JWKS, strict claim validation, and net/http middleware.
1 min readCSP, postMessage events, themes, and embed parameters.
Allow the EmbedAuth iframe under a strict CSP — the exact frame-src directive, the email-redirect origin most people miss, and per-framework header examples.
1 min readEvery event the EmbedAuth iframe emits over window.postMessage — types, payloads, when they fire, the origin check you must perform on all of them, and how to refresh tokens.
3 min readWhich emails EmbedAuth sends on your behalf and why they need no setup from you — plus the MX, SPF, DKIM and DMARC records to publish when you want your own domain to send and receive mail.
6 min readLet your users manage their own accounts — name, password, signed-in devices and account deletion — with a second embeddable widget you design exactly like the sign-in form.
5 min readDelete a user's EmbedAuth sign-in from your own server with your app's client secret, and, in GDPR mode, fetch a copy of everything EmbedAuth holds about them.
3 min readTurn on EU GDPR or UK GDPR mode for an app to get permanent deletion, fixed retention, data exports, self-hosted fonts, a Data Processing Agreement and, for the UK, a privacy complaints channel.
2 min readFix cookie, CSP, and OAuth problems fast.
Create a free account and have your first embed running in minutes.