Embedded iframe¶

The Sahl AI panel runs inside your EHR in an <iframe>. The clinician records the consultation, reviews the generated note and codes, and presses Send to EHR. The panel then posts the results to your page with window.postMessage.

sequenceDiagram
    autonumber
    participant BE as Your backend
    participant EHR as Your EHR page
    participant Panel as Sahl AI panel (iframe)
    BE->>BE: Get access token (or sign JWT)
    EHR->>Panel: Load iframe
    Panel-->>EHR: SAHL_IFRAME_READY
    EHR->>Panel: SAHL_IFRAME_INIT { token, patient, encounter }
    Note over Panel: Clinician records, reviews, edits
    Panel-->>EHR: Clinical note
    Panel-->>EHR: Codification (icd-automation)
    EHR->>EHR: Populate chart fields

Launch modes¶

Mode	Entry point	Credential	Use for
Secure handshake	`https://dev.sahl-ai.pages.dev/iframe-secure`	Access token from username and password	Recommended
Secure JWT handshake	`https://dev.sahl-ai.pages.dev/jwt-auth-secure`	Signed assertion (PKI)	Recommended with PKI
Access token in URL	`https://dev.sahl-ai.pages.dev/iframe?access_token=…`	Access token	Proofs of concept only

In both secure modes, tokens and patient identifiers travel by postMessage and never appear in the URL. That keeps them out of browser history, Referer headers and proxy logs. All modes produce the same write-back messages.

Browser permissions¶

The panel needs microphone access. For teleconsultations, where the patient's voice comes from a video call in another tab or window, it also needs screen and tab audio capture:

<iframe src="https://dev.sahl-ai.pages.dev/iframe-secure"
        allow="microphone; display-capture"
        style="width:100%; height:100%; border:0"></iframe>

Permission	Required	Why
`microphone`	Always	Captures the clinician and, for in-room consultations, the patient.
`display-capture`	Teleconsultation	Captures the remote patient's audio from the call tab. Without it, only the clinician is recorded.

Recording starts with a click inside the panel

Browsers allow audio capture only after the user clicks inside the iframe itself. A click in your page does not count. When display-capture is used, the browser also shows a sharing picker each time. The clinician selects the consultation tab and ticks Share tab audio. For these reasons the panel cannot start recording automatically.

Layout¶

Give the panel at least 400 × 600 px. A side drawer or a resizable split pane suits most EHR layouts.
Keep the iframe mounted for the whole consultation. If you unmount it while recording, the recording stops.
To close your container when the clinician finishes, listen for the sahl:close message.

Content Security Policy¶

If your EHR sends a Content Security Policy, allow the panel origin as a frame source:

Content-Security-Policy: frame-src https://dev.sahl-ai.pages.dev;

Also tell Sahl AI which origins will embed the panel. Sahl AI can then restrict framing to your domains.