Overview
The OFAuth Link Embed library provides pre-built components and a seamless popup flow for hosted link account authentication. Instead of redirecting users away from your application, the embed library allows users to authenticate within your site using popups, iframes, or web components.Best User Experience: The Embed library provides the most seamless authentication experience for your users while maintaining the security benefits of hosted mode.
Features
- Popup Integration: Open authentication in a popup window without leaving your application.
- Multiple Implementation Options: JavaScript library, global script, or web component.
- Theme Support: Light and dark themes to match your application.
- Async Event Handling: Rich event system for handling success, close, and invalid session events, with support for
asynccallbacks. - Automatic Session Renewal: Built-in
onInvalidSessioncallback to handle expired sessions gracefully. - TypeScript Support: Full TypeScript definitions for a better development experience.
- Framework Agnostic: Works with React, Vue, Svelte, vanilla JavaScript, and more.
Security: Allowed Origins & CSP
OFAuth enforces where your Link iframe may be embedded using Content Security Policy (CSP)frame-ancestors.
Allowed Origins
Configure trusted web origins in your OFAuth dashboard. Only these origins can embed the hosted Link page.
CSP Enforcement
The hosted Link page sets
Content-Security-Policy: frame-ancestors 'self' <your-origins...>.
Browsers block embedding from unlisted origins.Configuration Rules
- Provide full origins, e.g.
https://app.example.com(scheme + host, optional port) - Wildcards are not supported; list each origin explicitly
- An empty list means only
'self'(no third‑party iframes) - Changes apply to newly loaded sessions immediately
Troubleshooting
- If the embed fails to appear or the browser console shows a CSP error mentioning
frame-ancestors, add your site’s origin to Allowed Origins - If you see a “Link is misconfigured” screen, verify your dashboard’s Allowed Origins and Allowed Redirect URIs (see Hosted guide)
Installation
NPM Package
CDN (Global Script)
Implementation Options
The embed library offers three implementation approaches to fit different use cases:JavaScript Library
Advanced Control - Full programmatic control with TypeScript support. Perfect for React, Vue, or complex applications.
Global Script
Quick Integration - Simple HTML attributes for rapid implementation on any website.
Web Component
Modern Standard - Use as a native web component in any framework or vanilla HTML.
JavaScript Library (Recommended)
The JavaScript library provides the most control and is perfect for modern web applications.Basic Usage
Handler API
Thecreate() method returns a handler object with the following interface:
Configuration Options
| Option | Type | Required | Description |
|---|---|---|---|
url | string | ❌ | Optional default Link session URL. Can be passed to open(). |
theme | 'light' | 'dark' | 'auto' | ❌ | Theme for the authentication interface (default: ‘auto’). |
onSuccess | (metadata: SuccessMetadata) => void | ❌ | Callback when authentication succeeds. Can be async. |
onClose | (metadata: CloseMetadata) => void | ❌ | Callback when user closes the embed. Can be async. |
onLoad | () => void | ❌ | Callback when the iframe is fully loaded. Can be async. |
onInvalidSession | () => void | ❌ | Callback when the session is invalid. Can be async. |
Global Script Integration
For quick integration without a build process, use the global script approach with HTML data attributes.Basic Usage
Event Handling
With the global script, you can listen for DOM events on the trigger element.Global Script Attributes
| Attribute | Description | Required |
|---|---|---|
data-ofauth-link | Marks the element as an authentication trigger | ✅ |
href | The Link client session URL | ✅ |
data-ofauth-theme | Theme: ‘light’, ‘dark’, or ‘auto’ (default: ‘auto’) | ❌ |
Web Component
Use the embed as a native web component in any framework or vanilla HTML.Basic Usage
Event Handling
Web Component Attributes
| Attribute | Type | Required | Description |
|---|---|---|---|
url | string | ✅ | The Link client session URL |
theme | 'light' | 'dark' | 'auto' | ❌ | Theme (default: ‘auto’) |
label | string | ❌ | Button text (default: ‘Connect Account’) |
Session Expiry & Renewal
Link sessions expire after 6 hours. The embed library makes it easy to handle this by listening for theonInvalidSession event when using the JavaScript library.
Event Data Types
SuccessMetadata
{CONNECTION_ID}, the success event
receives the fully expanded URL, so you can redirect immediately or record the
identifier without additional lookups.
CloseMetadata
Global Script Events
| Event | Detail Type | Description |
|---|---|---|
success | { metadata: SuccessMetadata } | Fired when authentication succeeds |
close | { metadata: CloseMetadata } | Fired when user closes the embed |
loaded | null | Fired when the iframe is ready |
invalid_session | null | Fired if the session is not valid |
Styling and Themes
Built-in Themes
The embed library includes three built-in themes:- Light Theme: Clean, bright interface suitable for light backgrounds
- Dark Theme: Modern dark interface for dark mode applications
- Auto Theme: Automatically adapts to system preference
Custom Styling
The trigger elements can be styled with regular CSS. For web components, use CSS parts:Error Handling
Common Scenarios
Session Expiry
Link sessions expire after 6 hours. Handle expired sessions gracefully:Browser Support
The Link Embed library supports all modern browsers:- Chrome/Edge: Latest versions
- Firefox: Latest versions
- Safari: Latest versions
- Mobile Browsers: iOS Safari, Chrome Mobile
Internet Explorer: Not supported. The library uses modern web APIs that are not available in IE.
Performance Optimization
Preloading
The handler API provides better performance by pre-initializing the authentication iframe:Resource Management
Always clean up handlers when they’re no longer needed:Troubleshooting
Popup Blocked by Browser
Popup Blocked by Browser
Some browsers may block popups. Ensure the authentication trigger is initiated by a user action (click event).
Handler Not Ready
Handler Not Ready
Wait for the handler to be ready before opening:
CORS Issues
CORS Issues
The embed library handles CORS automatically. If you encounter issues, ensure:
- Your domain is properly configured in your OFAuth dashboard
- You’re using HTTPS in production
- The session URL is valid and not expired