Embed Demo — TradeClick

Live preview

This is the real /embed route, framed live below. Switch pages with the buttons.

This preview frames /embed from the same origin. Your own origin must be allowlisted before it will render on your domain.

Integration code

Drop this into your platform, replacing YOUR_SLUG with the broker slug TradeClick assigns you.

<iframe
  src="https://tradeclick.io/embed?broker=YOUR_SLUG&page=marketplace"
  width="100%"
  height="600"
  loading="lazy"
  title="TradeClick"
  style="border:1px solid rgba(255,255,255,0.1); border-radius:12px;"
></iframe>

Available pages: marketplace (strategy grid), strategy (one strategy, needs &slug=), creator (one creator profile, needs &username=), and help (a compact FAQ). Only the pages you've asked us to enable will render — anything else shows a friendly "not available in this embed" message.

Auth-required actions open a new tab, by design. The embed is third-party context to your visitor's browser — storage is commonly partitioned or blocked there, so TradeClick never attempts to sign a trader in in-frame. Activate / Follow / Copy actions always open tradeclick.io in a new tab instead.

Full endpoint reference, error codes, and the embed-config shape live in the Partner API documentation — ask your TradeClick contact for access.

SSO flow — deep-link handoff

A trader can jump straight from "Trade with TradeClick" in your platform into a signed-in TradeClick session, without re-typing anything you already know about them.

1

Trader clicks "Trade with TradeClick" in your platform

Any button, link, or menu item you place in your own UI.

2

Your server signs a short-lived JWT assertion

HS256, signed with your SSO secret, expiring ≤120 seconds from issuance. Signing happens server-side only — see the code example in the Partner API documentation.

3

Redirect to TradeClick with the signed token

https://tradeclick.io/v1/b2b/sso?token=…

4

TradeClick validates the assertion

Signature, expiry, and single-use jti are all checked before anything else happens.

5

Trader signs in or signs up on TradeClick

Their email is pre-filled from your assertion, but they still complete authentication themselves.

6

After they authenticate, their broker account links to their TradeClick account

Linking only ever happens post-authentication — never before.

7

They return to your return_url

Only if it falls under one of your allowlisted origins — otherwise it's ignored.

TradeClick never creates an account from your assertion alone — the trader always authenticates with us directly. This is what stops a leaked partner secret from becoming account takeover.

Integration checklist

Get your API key and SSO secret from TradeClick — issued once, server-side only.
Send us your exact origins (e.g. https://app.broker.com — full scheme + host + port, no wildcards) for both the embed allowlist and SSO return_url allowlist.
Ask us to enable embed and SSO on your partner account.
Drop in the iframe from the snippet above, pointed at your assigned broker slug.
Sign SSO assertions server-side only — never in a browser page, mobile app, or public repository.

Security notes

Your SSO secret is server-side only — it must never reach browser JS, a mobile app bundle, or a public repository.

Assertions expire in 120 seconds and are single-use — each jti is accepted exactly once; a replayed token is rejected.

Origins are exact-match — scheme, host, and port must match one of your allowlisted origins exactly. No wildcards.