Prerequisites

• The user must exist — call POST /v1/users:upsert on sign-in and store the returned id.
• You need a V1 API key issued by Uptop. The API key stays on your server — it is exchanged for a short-lived token before the iframe URL is constructed.

Authentication

Your backend exchanges the API key for a short-lived JWT and passes it to the client as iframeToken. The API key never leaves your server.

// Exchange API key for a short-lived iframe token (10 min)
const { accessToken } = await fetch(
  `${UPTOP_API_BASE}/v1/users/${userId}/auth/client-token`,
  { method: 'POST', headers: { 'Api-Key': process.env.UPTOP_API_KEY } }
).then(r => r.json());

// Return accessToken to the client — never the raw API key
return { iframeToken: accessToken };

Embed Code

One screen in your app, one iframe URL. It takes the userId and the iframeToken from the exchange above.

<iframe
  src="https://urbanspace-docs.uptop.xyz/embed/add-funds?userId={USER_ID}&iframeToken={TOKEN}"
  width="390"
  height="844"
  style="border:none;"
  allow="payment"
></iframe>

To point an embed at the dev API from a development build, add &env=dev to the URL. Leave it off in production: without it the embed talks to the production API, so existing integrations are unaffected. The live preview on the right follows the environment selected in the top bar.