> ## Documentation Index > Fetch the complete documentation index at: https://docs.firstwork.com/llms.txt > Use this file to discover all available pages before exploring further. # iFrame Embedding (Magic Link Login) > Embed Firstwork in your app with secure JWT-based auto-login via iframe ## Overview Embed the Firstwork hiring platform inside your own application using an ` ``` ## JWT Payload | Field | Type | Required | Description | | ---------------- | ------------- | ----------- | ----------------------------------------------------------------------------------------------------- | | `email` | string | Yes | Applicant's email address | | `first_name` | string | Yes | Applicant's first name | | `last_name` | string | Yes | Applicant's last name | | `hiring_flow_id` | string (UUID) | Conditional | Hiring flow identifier provided by Firstwork. Required if `funnel_name` is not provided. | | `scope` | string | Yes | Must be `LOGIN_FOR_APPLICANT` | | `funnel_name` | string | Conditional | Funnel slug for which the applicant will be registered. Required if `hiring_flow_id` is not provided. | | `exp` | integer | Yes | Expiration as a Unix timestamp. Keep short-lived (e.g. now + 5 minutes) | JWTs must be signed with the `HS256` algorithm. ## Configuration | Parameter | Description | | ------------- | ---------------------------------------------------------- | | `SECRET_KEY` | A shared secret to sign JWT tokens. Provided by Firstwork. | | Firstwork URL | `https://.firstwork.com/magic-login/` | ## Passing extra slug parameters > \[!NOTE] > To pass slug parameters for the application during registration, append them as query parameters to the iframe link: ``` https://.firstwork.com/magic-login?token=&workplace_id=<>&other_param=<> ``` ## Best practices 1. **Never expose `SECRET_KEY` in the frontend code.** 2. Always set a short expiration (`exp`) in the JWT. 3. Only embed Firstwork domains via HTTPS. 4. Log JWT generation events for traceability. 5. Use HTTPS on your backend endpoint to protect token transmission.