The token never reaches your page#

Components run in iframes on FinBaze's origin. The embed token lives in memory in a hidden controller iframe and is handed to component iframes over private MessagePorts. Your page can only send options and receive events, so a script injected into your page cannot read a token. The iframes use no cookies or browser storage.

Where components can run#

FinBaze serves components with a frame-ancestors policy built from your allowed origins, so a browser refuses to render them on any other site. The session can additionally be bound to one origin (origin in createEmbedSession), which the exchange enforces.

Single-use secrets#

A client secret works once, for 15 minutes. If it leaks after the legitimate iframe used it, it is worthless; if it leaks before, whoever exchanges first wins and the other fails with EMBED_SECRET_USED, which you can see in the audit log.

An allowlist of operations#

Embed tokens can only run GraphQL documents that FinBaze ships in its operations manifest, identified by a hash of the normalised document. Introspection and arbitrary queries are refused. The manifest also ties each operation to the components and component features that may use it, and to the company the session was created for.

Least privilege#

Every write an embed can perform is a deliberate entry in the registry. Sessions list the components they need; features such as submit are off unless you turn them on. Viewers cannot write.

Revocation and audit#

Revocation reaches every server within 15 seconds. Every change made through an embed is recorded in the company's audit log as "user via platform", with the session id.

Residual risks#

• XSS on your page. An attacker running script on your page can call your session endpoint as the logged-in user, take the fresh secret to their own server and exchange it there, faking the Origin header (only browsers enforce it). Mitigations: the legitimate iframe usually exchanges first, secrets are single use and short lived, origin binding, the operation allowlist, audit and revocation. This is the same class of risk as other embedded-component products; keep your own session endpoint behind your normal authentication and CSRF protection.
• Headless sessions hand a token to your page, by design. Enable them only if you need them; they are off by default and limited to origins you list separately.