← Developers

Embedded Help Center

Orstrax Desk separates how Help is delivered (standalone vs Embedded) from how users are authenticated (public, shared password, or App Authenticated).

Full integration guide (iframe, native API, App Authenticated JWT exchange, security): docs/embed-integration.md on GitHub.

Quick links

• Admin: Settings → Help center → Embedded
• Session exchange: POST /api/embed/v1/session
• Config: GET /api/embed/v1/config
• Knowledge: /api/embed/v1/categories, /articles, /search
• Tickets: /api/embed/v1/tickets

Concepts

• Unrestricted Embedded — embed without host-user sign-in; still enforce allowed origins.
• App Authenticated — only people signed in to your app can open Help. No Desk password, no separate Desk login.
• Sign-in provider (recommended) — send the user's existing ID token from Firebase Authentication or any OpenID Connect provider to POST /api/embed/v1/session. Desk verifies it against the provider's public keys, so there is no secret to create or store.
• Signed token (advanced) — for apps without a standard provider, your backend signs a short-lived JWT with a Desk signing secret instead.