Put a working tool on your page

Height messages

An iframe cannot size itself to its content, so the frame measures its own body and posts the number to the parent window whenever it changes. The snippet's script applies it. Write your own instead when you want to clamp the value or animate the change.

addEventListener('message', function (e) {
  if (e.origin !== 'https://vayce.app') return;
  if (e.data && e.data.type === 'vayce:embed-height') {
    // e.data.height is the frame's full content height, in CSS pixels.
  }
});

The height attribute in the snippet is not a setting. It is what a host renders before the script runs, or if it never does, and without it an iframe falls back to 150px. Each tool reports its own, so no two open at the same size. A pasted link carries no script at all, because oEmbed consumers strip <script>, so for that route the number is the height the frame keeps.

The allow attribute

A cross-origin iframe has clipboard write denied unless the host page delegates it. Most of these tools are built around a copy button, so allow="clipboard-write" is on every generated snippet. Nothing else is requested by default. The QR reader adds camera because it scans from a live stream. clipboard-read is never requested: it prompts the visitor, and no tool reads the clipboard.

Chrome parameters

Appended to the embed URL, and what the controls above write. They carry a _ prefix so they never collide with a tool's own settings, which use bare names.

Theme

A generated snippet matches the page it sits in. Its script reads the first opaque background behind the frame and tells the frame light or dark. It keeps watching after that, so a theme switcher on your site re-themes the tool without a reload. Set _theme=light or _theme=dark to pin the frame instead. A pasted link carries no host script or theme signal, so its oEmbed frame starts light.

Framing policy

Worth checking rather than taking on trust. Every other route here ships Content-Security-Policy: frame-ancestors 'self' and refuses to be framed at all. /embed/* deliberately carries no such header, which is the reason that route exists. Read the response headers on this page and on an embed URL.