Bolto iframe integration

​

Employer experience

1. Bolto creates the employer group and syncs the census from Check.
2. Later, when the employer opens the Prescience offer in Bolto, Bolto’s frontend asks Bolto’s backend for an embed session.
3. Bolto’s backend creates the short-lived session with Prescience and returns the response’s url to Bolto’s frontend.
4. Bolto renders that URL as the iframe src. The iframe shows animated, company-specific modeling while Prescience compares the group against current local market plans.
5. The iframe reveals Prescience Diamond with modeled employer cost, annual savings, benefits, network, and the comparison benchmark.
6. The employer clicks Finish setup on Prescience, verifies a work email with a six-digit code, and clicks Open my workspace.
7. Prescience creates hosted onboarding and opens a one-use authenticated handoff in a new tab. The employer’s company and census are already loaded.

​

1. Create the group and census

curl -X POST https://www.getprescience.com/api/partner/v1/groups \
  -H "Authorization: Bearer $PRESCIENCE_API_KEY" \
  -H "Content-Type: application/json" \
  -d '{
    "companyName": "Northstar Labs",
    "domain": "northstarlabs.com",
    "contact": {
      "name": "Alex Morgan",
      "email": "alex@northstarlabs.com"
    }
  }'

​

2. Mint the iframe URL from Bolto’s backend

curl -X POST https://www.getprescience.com/api/partner/v1/groups/grp_8c2f41d09a3e/embed-sessions \
  -H "Authorization: Bearer $PRESCIENCE_API_KEY"

{
  "token": "f4b7...",
  "url": "https://www.getprescience.com/embed/partners/bolto/groups/grp_8c2f41d09a3e?token=f4b7...",
  "expiresAt": "2026-08-11T23:10:00.000Z"
}

​

3. Render it in Bolto

const PRESCIENCE_BASE = "https://www.getprescience.com/api/partner/v1";

export async function createPrescienceEmbedSession(groupId: string) {
  const response = await fetch(
    `${PRESCIENCE_BASE}/groups/${groupId}/embed-sessions`,
    {
      method: "POST",
      headers: {
        Authorization: `Bearer ${process.env.PRESCIENCE_API_KEY}`,
      },
    },
  );

  if (!response.ok) throw new Error(await response.text());
  const { url, expiresAt } = await response.json();

  // Return these two fields from Bolto's authenticated backend route.
  return { url, expiresAt };
}

function PrescienceOffer({ groupId }: { groupId: string }) {
  const [url, setUrl] = useState<string>();

  useEffect(() => {
    fetch(`/api/prescience/groups/${groupId}/embed-session`, { method: "POST" })
      .then((response) => response.json())
      .then((session) => setUrl(session.url));
  }, [groupId]);

  if (!url) return <div>Opening your Prescience plan...</div>;

  return (
    <iframe
      src={url}
      title="Prescience plan for your company"
      style={{ width: "100%", minHeight: 900, border: 0, borderRadius: 24 }}
    />
  );
}

• Use the full content width. Size the height from the iframe’s resize message; until the first one arrives, start at about 900px on desktop.
• Give the iframe a dedicated route or full-width drawer, not a small modal.
• On mobile, use the full viewport width and allow vertical scrolling.
• If the session expires, request a new session from Bolto’s backend and replace src.
• Do not overlay Bolto controls on the iframe’s call-to-action or email fields.

​

Look and feel

​

Size the iframe to its content

window.addEventListener("message", (event) => {
  if (event.origin !== "https://www.getprescience.com") return;
  if (event.data?.type === "prescience:resize" && iframeRef.current) {
    iframeRef.current.style.height = `${event.data.height}px`;
  }
});

​

Iframe sandbox

​

What the iframe calls

​

Framing allowlist

https://team.bolto.com
https://team.bolto-staging.com

​

Bolto acceptance test

​

Go-live checklist

• Prescience has Bolto’s staging and production iframe origins.
• Bolto has separate sandbox and production secrets.
• Bolto completed the acceptance test above with synthetic data.
• Prescience turned on live mode.
• Recommended, not required: Bolto registered and tested a webhook endpoint.
• Bolto swaps only the secret at launch. The endpoint and payload shapes stay the same.

​

Related guides

• Authentication
• Census sync
• Webhooks
• Enrollment