Skip to main content

​
Overview

Your app runs in a sandboxed iframe with no access to Elata’s cookies, backend, or the user’s wallet. When it needs something from the platform, such as a purchase, saved data, or consent, it sends a postMessage to the parent frame. Elata does the work with the user’s session and replies. Your app never sees who the user is. It only gets the answers it needs.

​
Use the SDK packages

For most features there’s a small package that wraps the messages, timeouts, and errors for you: Consent, insights, notifications, navigation, and feedback use plain postMessage calls. They’re documented below and on their own pages.

​
Ground rules

  • Send to the parent. Post to window.parent. Using '*' as the target origin is fine: Elata checks that the message came from your app’s frame and origin.
  • Use a requestId. Where a reply is expected, include a unique requestId (8 to 128 characters; crypto.randomUUID() works) and match it on the reply.
  • Handle no reply. Outside Elata (for example in local development) nobody answers. Use a timeout and degrade gracefully. The SDK packages do this for you.
  • Elata is the source of truth. Prices, ownership, and consent always come from Elata, never from values your app sends.

​
Message reference

​
Purchases

Use app-payments instead of sending these by hand.

​
App state

Once @elata-biosciences/app-state is on npm, prefer it over sending these by hand. See App state.

​
Metrics

app-metrics uses a dedicated MessageChannel set up with a __elata_metrics_init handshake, not individual window messages. Always use the package. See Consent and insights.

​
Notifications

See Notifications. Send the user to another app’s play page in Elata:
slug must be an Elata app slug: lowercase letters, digits, and dashes, up to 64 characters. There’s no reply.

​
Feedback

Elata’s floating feedback button is hidden while an app is playing, so it doesn’t cover your controls. Open Elata’s feedback panel from your own UI instead:
There’s no reply.