Orderly Embed SDKs

Orderly Embed uses two SDK layers:

1. Your authenticated backend creates a short-lived, scoped session with @orderly/node or the Java SDK.
2. Your frontend renders the live embed with @orderly/embed-react or @orderly/embed-js.

The browser SDK sends the est_ client secret to the Orderly iframe through a validated postMessage handshake. It never places a client secret in a URL.

Customer browser ──POST──> Your backend ──oh_ key──> Orderly API
       │                         │
       │<──── est_ secret ───────┘
       │
       └── secure handshake ──> Orderly Embed iframe

Before you start

• Create a dedicated API key with embed:manage.
• Configure every exact customer-app origin under Embed → Settings.
• Activate Embed and choose the allowed features and bridge types.
• Derive externalId from your authenticated server session. Never accept it directly from an untrusted request body.

Packages

Environment	Package	Purpose
Node.js 18+	@orderly/node	Create and revoke embed sessions
Browser	@orderly/embed-js	Framework-neutral iframe lifecycle and events
React 18/19	@orderly/embed-react	React component backed by the browser SDK
Java 17+	dev.orderly:orderly-java	Create and revoke embed sessions

Session lifetimes are 60–3600 seconds and default to 900 seconds. The browser SDK asks your backend for a new secret before the current session expires.

Production URLs

• Hub API: https://api.orderly-hub.com/api/v1
• Embed iframe: https://embed.orderlycore.com/embed/bridges
• Browser bundle: https://cdn.orderlycore.com/embed.min.js

The npm and Maven packages, and the CDN hostname, must be published/configured before external consumers can install them. Repository builds can be consumed directly for pre-release integration testing.