Both take a UUID in the path. They read no query parameters. Any site may frame them, because they send
Content-Security-Policy: frame-ancestors *. They are not indexed by search engines.
Market iframe
allow="clipboard-write" is recommended.
Get market IDs from GET /api/markets.
Thread iframe
- the thread’s title, description, time remaining and total predictions
- an amount selector and a Yes/No toggle
- a heatmap grid of the thread’s markets, highest volume first, loaded with
status=allso ended markets still appear with their status
GET /api/threads. If a thread has no markets, the widget shows an empty state.
Recommended attributes
If you sandbox the frame, the widget needs at least
allow-scripts allow-same-origin allow-popups allow-popups-to-escape-sandbox, so it can run, call the API, and open X and market pages in new tabs. Don’t grant allow-top-navigation. The widget never needs to navigate your page.
To shrink the frame on small screens, use a media query:
frame-src https://app.kash.bot.
Events
The widgets post messages to the parent window, addressed to your page’s origin. Every message has the shape{ type, data, origin: "https://app.kash.bot", timestamp }:
Troubleshooting
- “Not found” inside the frame. The ID isn’t a UUID or doesn’t exist.
- A thread shows no markets. Check
GET /api/threads/{id}/markets?status=all. - Nothing happens when a visitor predicts. A sandbox without
allow-popupsblocks the X tab. Handlekash-open-twitter, or loosen the sandbox.
Next steps
Quickstart
Embed your first market
HTML examples
Copy-paste pages