embed.withheadlight.com. React only hosts the iframe and talks to it with postMessage. Headlight servers never receive names, trusts, or relationship data.
Component
Copy this component. It targets React 19. On React 18, keep the latesttoken and data in refs instead of useEffectEvent. Mint the token on your server, then pass it in as a prop.
/chart/v0.1.0/index.html). Do not load /chart/latest.
Usage
Use the Calderwood sample payload aschartData.
frameOrigin on the mint request must be the origin of the page that hosts this component (bare origin, no trailing slash).
Token
Mint from your server with an API key that hasembed:chart. Pass the JWT into the component. Do not call the mint route from the browser or ship that API key to the client.
Updates and commands
Changingtoken or data posts another render. That replaces the graph.
To search or reset the view after ready, post to the iframe the same way the component posts render:
focus and exclude.
Sandbox
Use exactlysandbox="allow-scripts allow-same-origin". Do not add allow-top-navigation or allow-popups.
What not to do
Always pass the embed CDN origin aspostMessage targetOrigin. Do not use *.