A robust third-party embed is not just an iframe with width: 100%. Our preferred public API is a
purpose-named custom element backed by a vendor-origin iframe. It is still two documents with a
small protocol between them: the host owns placement and width; the iframe owns application logic,
storage, and sensitive inputs; a deliberately narrow message contract connects the two.
This guide distills lessons from building and browser-testing embedded forms and booking flows.