Launcher and iframe

SKU 2 is a floating image button (same idea as Find-A-Code and HCC Coder). Click opens the full tenant page in a new tab. There is no in-page chat iframe inside the script. The widget never mints tokens and never sees your API key.

Launcher snippet

<script src="https://api.askaimee.com/widget/widget.js"
        data-tenant="new-company"
        async></script>

data-tenant is your app_slug. The button opens your tenant page; users without a session are redirected to login.askaimee.com to sign in with their Aimee account, then land back on your tenant.

The button image is the Aimee launcher on the API host — it does not use your tenant logo. Tooltip and accessible name stay “Aimee — AI coding assistant”.

SSO integrations can add data-session-token="{{token}}" rendered from a token your backend minted with POST /v1/hosted-session — that skips the sign-in page. data-user-id is ignored and must not be used to open another person’s inbox. See end-user identity.

Iframe the full page

If Aimee should appear inside your layout, iframe the tenant URL yourself. Use a minted token for SSO, otherwise users sign in through the login page:

<iframe src="https://new-company.askaimee.com/?token={{token}}"
        title="Aimee"
        style="width:100%;min-height:720px;border:0;"></iframe>

Embedding is controlled by CSP frame-ancestors from the client’s allowed_origins (plus 'self'). An empty list sets X-Frame-Options: SAMEORIGIN so only the first-party tab / launcher works until sales adds origins. Origins do not isolate users.

Ask sales to set origins such as https://app.example.com (scheme + host, optional port). Disallowed parents will not display the iframe. Cross-site iframes should send the token as X-Aimee-Hosted-Token because third-party cookies may be blocked. The ?token= query works on the initial page load; the hosted page then moves it to sessionStorage and strips it from the URL.