Communication
Hosted components communicate with your application through:- URL Parameters: Pass configuration and theming data through query parameters
- PostMessage Events: Send and receive form lifecycle events through the
postMessage
API.
Authentication
To prevent JWT tokens from being logged or cached in URLs, these must be sent through the postMessage API. To ensure security, we validate the origin of all messages received in iFrames against the origin specified in the JWT. This means you must embed the iFrame within a website hosted on your specifiedallowed_origin
.
You must specify the destination origin in
postMessage
to prevent leaking tokens to untrusted websitesTheming
Hosted components support comprehensive theming through URL parameters. You can customize the appearance by passing color and styling properties in the URL query string.Color Properties
Pass color values using these URL parameters:background
- Main background colorforeground
- Primary text colorpopover
- Popover background colorpopoverForeground
- Popover text colorprimary
- Primary brand colorprimaryForeground
- Primary button text colorsecondary
- Secondary background colorsecondaryForeground
- Secondary text colordestructive
- Error/destructive action colorborder
- Border colorring
- Focus ring colormuted
- Muted background colormutedForeground
- Muted text color
Dark Mode Support
For dark mode theming, prefix any color property withdark-
:
dark-background
- Dark mode background colordark-foreground
- Dark mode text colordark-primary
- Dark mode primary color- etc.
Additional Properties
radius
- Border radius (e.g.,0.5rem
,8px
)fontFamily
- Font family name