IframeEmbed · Playground

⚙️ Mount configuration

App URL

HTTPS required, except localhost / 127.0.0.1. Load destroys the current instance and mounts a fresh one.

sandbox allowedOrigin (optional, comma-separated) overlaySamplingMode appReadyTimeout (ms) strictOriginValidation enableOverlayDetection Enforce allowedMessageTypes debug enableMetrics

Metrics off by default — when on, reports go to the telemetry worker. Keep it off in a shared playground.

🔄 Lifecycle

✉️ Send message to guest

type payload (JSON)

Quick presets:

🔒 Security tests

🔍 Introspection