Skip to main content
The hosted widget runs in an iframe. Use the exact message contract from the generated embed, accept events only from the configured Chatropic origin, validate the event type, and match the requested path against an allowlist before passing it to your router. Require the current application session for protected routes. Never accept arbitrary absolute URLs or execute code received through postMessage.