If you need iframe isolation, use the Web SDK with
connectUrl instead of loading Hosted Link inside an iframe. Hosted Link is intended to be launched directly.User tokens and session links both expire after one hour. Create a fresh user token before initializing Link with
userToken, or create a new session link for an active verification before initializing Link with connectUrl.Before you start
- When using a webview component, make sure
localStorageis enabled,domStorageEnabledis set totrue, andincognitois set tofalse. - If your security policy limits outgoing traffic, allow Link API calls by whitelisting outgoing traffic from Link with these content sources at minimum:
Initialize with userToken
Use this path for direct embedded Link implementations that use user tokens. Create a user token on your server:- New users: create the user via
POST /v2/usersand use the returneduser_token. - Returning users: create a new token via
POST /v2/user-tokensand use the returneduser_token.
Initialize with connectUrl
Use this path when your backend creates a payroll verification session.- Create a session via
POST /v2/sessions. - Copy the response
link. - Pass that value as
connectUrlin your Web SDK initialization.
link to the banking SDK as connectURL.
The session URL already determines whether Link runs in Sandbox or Production. Do not pass sandbox with connectUrl.
Track Link activity
Embedded Web Link supports callbacks, includingonAccountConnected, onAccountError, onClose, and onTokenExpired.
For verification workflows, also subscribe to verifications.updated webhooks so your backend can track the verification lifecycle.