Skip to main content

Browser, React, embedded, and hosted

Render an assessment using a token scoped to one participant session—never an app or environment credential.
The only Synapse credential allowed in browser JavaScript is a short-lived spt_ participant token. Keep environment keys server-side, and handle shr_ report-share tokens only in the separate controlled report-view flow.

Controller

Pinned consent, next-question state, answer/unknown/decline, pause/resume, completion, and callbacks.

Embedded renderer

Dependency-free UI mounted in your DOM with your controller and surrounding brand.

Hosted renderer

A hardened iframe handoff using the server-returned hosted URL and a fragment token.

React adapter

An external-store hook that keeps rendering separate from the transport lifecycle.

Embedded journey

Hosted journey

  • The controller sends the server-pinned consent_accepted event before any restored or new participant traffic.
  • mountEmbeddedParticipant starts the controller. Do not call start() a second time after mounting.
  • Use MemoryParticipantQueueStorage by default. Local storage can retain assessment content in clear text and needs an explicit privacy review.
  • Use an opaque evaluation reference as the queue key—never the participant token, an external ID, or a report token.
  • skip records unknown; decline records an explicit refusal. Neither is imputed as a negative answer.
  • Call dispose() and destroy the renderer when the host view unmounts.