Access token in URL

GET https://dev.sahl-ai.pages.dev/iframe?access_token=...

The simplest launch mode: the access token and context go in the iframe URL.

Use for proofs of concept only

Tokens in URLs can end up in browser history, Referer headers, proxy logs and screenshots. For production, use the secure handshake. Moving to it later means changing the URL and adding about 15 lines to your message listener. Your result handling stays the same.

Embed

<iframe
  src="https://dev.sahl-ai.pages.dev/iframe?access_token=ACCESS_TOKEN&px_id=PATIENT_ID&ex_id=ENCOUNTER_ID&age=16436&gender=female"
  allow="microphone; display-capture"
  style="width:100%; height:100%; border:0"></iframe>

URL-encode every value. Build the URL on your server, or with URLSearchParams:

const url = new URL("/iframe", "https://dev.sahl-ai.pages.dev");
url.search = new URLSearchParams({
  access_token: ACCESS_TOKEN,
  px_id: patient.id,
  ex_id: encounter.id,
  age: String(ageInDays(patient.dateOfBirth)), // see Launch parameters
  gender: patient.gender, // "male" | "female"
  cta: "Send to EHR",
}).toString();
sahlFrame.src = url.toString();

The supported parameters are listed in Launch parameters. Unknown parameters are ignored.

Receive results

Listen for messages exactly as in the secure modes, and always check the origin:

window.addEventListener("message", (event) => {
  if (event.origin !== "https://dev.sahl-ai.pages.dev") return;
  handleSahlData(event.data);
});

See Write-back messages.