Skip to main content
The chart still loads from embed.withheadlight.com. React only hosts the iframe and talks to it with postMessage. Headlight servers never receive names, trusts, or relationship data.

Component

Copy this component. It targets React 19. On React 18, keep the latest token and data in refs instead of useEffectEvent. Mint the token on your server, then pass it in as a prop.
Pin an immutable version prefix (/chart/v0.1.0/index.html). Do not load /chart/latest.

Usage

Use the Calderwood sample payload as chartData.
frameOrigin on the mint request must be the origin of the page that hosts this component (bare origin, no trailing slash).

Token

Mint from your server with an API key that has embed:chart. Pass the JWT into the component. Do not call the mint route from the browser or ship that API key to the client.

Updates and commands

Changing token or data posts another render. That replaces the graph. To search or reset the view after ready, post to the iframe the same way the component posts render:
See the postMessage protocol for focus and exclude.

Sandbox

Use exactly sandbox="allow-scripts allow-same-origin". Do not add allow-top-navigation or allow-popups.

What not to do

Always pass the embed CDN origin as postMessage targetOrigin. Do not use *.