Iframe
Advanced! Developers with backend access to your LMS/Website is required for this method to work
Copy the Iframe
Each activity requires a specific iframe configuration. Here’s the base template:
Do I have to copy the iframe every time? Or can I make it more dynamic?
Do I have to copy the iframe every time? Or can I make it more dynamic?
You do not need to copy the iframe every time. You are free to make it more dynamic by generating the iframe on your side, but in order to get the user into the correct activity, we will need the following:
src attributes:
a base url
(typically https://yourcompany.replay.sale)activityId
(the unique id of the activity you want to load)activityType
(the type of activity you want to load)integrationJwt
(a signed JWT that has the required claims. See step 2 for more details)
iframe attributes:
allow="microphone; camera; clipboard-write; downloads; display-capture"
microphone
andcamera
allow us to record the userclipboard-write
allows the user to copy a link to their roleplay analysisdownloads
allows the user to download their audio / video recording
Generate a Signed JWT
You must generate a unique JWT for each user using your secret key. The JWT requires these claims:
learnerName
- User’s name (first, last, or both)uniqueIdentifier
- Your database’s unique identifier for this user (UUID, email, etc.)originDomain
- Your company’s domain identifier (see details below)
What is originDomain and how should I set it?
What is originDomain and how should I set it?
The originDomain
is used to namespace users and prevent collisions between different companies or systems. Here’s what you need to know:
Purpose: If you use simple identifiers like 1
, 2
, 3
for users, and another company also uses 1
, 2
, 3
, we need a way to distinguish between “User 1 from Company A” and “User 1 from Company B”.
How to set it:
- Use your main company domain (e.g.,
mycompany.com
,microsoft.com
,google.com
) - It does NOT need to match the actual domain where the iframe is hosted
- Use the same value consistently for all users within your organization
- For multi-tenant systems, you can use the same domain for all your customers
Examples:
- Single company:
"originDomain": "mycompany.com"
- Multi-tenant SaaS:
"originDomain": "mycompany.com"
(same for all customers)
Multi-Company Setup & Security
Multi-Company Setup & Security
If you manage multiple separate companies/clients:
Each company should have its own secret key for security. This ensures that:
- Company A cannot access Company B’s activities, even if they somehow obtain an iframe URL
- Users are properly isolated between companies
- Activity access is controlled at the company level
How it works:
- Each activity belongs to a specific company in Replay
- The secret key you use to sign the JWT determines which company the user belongs to
- When a user accesses an activity, we use the activity ID to look up which company owns it
- We then validate the JWT signature against that company’s secret key
- Users can only access activities if their JWT was signed with the correct company’s secret key
Setup Process:
- Create separate child companies in Replay for each of your clients
- Get a unique secret key for each company
- Store and use the appropriate secret key when generating JWTs for each company’s users
Contact us at hello@replay.sale to set up multiple companies and get separate secret keys.
Need a secret key or lost yours? Contact us through email (hello@replay.sale) or Slack
Implement the Integration
- Generate the signed JWT for your user
- Replace
<INPUT_INTEGRATION_JWT>
in the iframe src with your signed JWT - Load the iframe
Best practice: Create a function that handles JWT generation and iframe src updates before loading
Test Your Integration
Load your page and verify that:
- The iframe loads successfully
- User information is correct
- Recording permissions work
- Downloads function properly
Need help? Contact us at hello@replay.sale
Code Examples
Frequently Asked Questions
How do I handle multiple companies/clients in my system?
How do I handle multiple companies/clients in my system?
Each company should be set up as a separate entity in Replay with its own secret key.
Setup process:
- Contact us to create child companies for each of your clients
- Get a unique secret key for each company
- Store the appropriate secret key for each company in your system
- Use the correct secret key when generating JWTs for users belonging to that company
Security: This ensures that users from Company A cannot access Company B’s activities, even if they somehow obtain an iframe URL from Company B.
What should I use for originDomain in a multi-tenant system?
What should I use for originDomain in a multi-tenant system?
Use the same domain for all your customers (e.g., "mycompany.com"
).
The originDomain
is for namespacing users between different systems, not between customers. Since all your customers’ users are coming through your system, they should all use the same originDomain
.
Company separation is handled by:
- Using different secret keys for each company
- Each activity belonging to a specific company in Replay
Can users access activities from other companies?
Can users access activities from other companies?
No, if set up correctly.
Here’s exactly how the security validation works:
- When a user accesses an activity, we use the activity ID from the iframe URL to look up which company owns that activity
- We then validate the JWT signature against that specific company’s secret key
- If the JWT wasn’t signed with the correct company’s secret key, access is denied
This means even if a user somehow gets an iframe URL for a different company’s activity, they won’t be able to access it because their JWT was signed with their own company’s secret key, not the target company’s secret key.
Do I need different originDomain values for different customers?
Do I need different originDomain values for different customers?
No. The originDomain
is used to distinguish between different integration systems (e.g., “Microsoft vs Google”), not between customers within the same system.
If you’re managing multiple customers through your platform, use the same originDomain
for all of them. Company separation is handled through different secret keys and the activity ownership system.
Message Passing
After the user completes the roleplay, the iframe will send messages to the parent window containing information about the user’s performance and progress. To receive these messages, you’ll need to set up an event listener in your parent window.
Setting Up the Listener
Add this code to your parent window to receive messages from the Replay iframe:
When do we pass the message?
The message will be passed when the “Analysis” page is loaded for a roleplay that has been completed within the past 1 minute.
Message Interface
The message type will always be “roleplay_result” and will contain both the overall score and the complete result object.