Skip to content

Authentication and security

Plugins never receive global Elo login tokens or cookies. They receive context and a temporary capability scoped to installation, user and meeting. Identify the user through the declared identity:read permission.

sequenceDiagram
  participant P as Plugin iframe
  participant E as Elo host
  participant A as Elo API
  P->>E: elo.ready
  E-->>P: elo.context (nonce, scopes, grant)
  P->>E: elo.request (requestId, operation)
  E->>A: Validate installation, user and meeting
  A-->>E: Authorized result
  E-->>P: elo.response (same requestId)

Iframe SDK

The SDK checks the exact origin and parent window, correlates requestId and uses the host nonce. The bridge supports eight in-flight operations; SDK requests time out after 30 seconds. Catch errors and clear loading. Never use * with postMessage.

External backend

Context may include session: { token, endpoint, expires }. Grants last five minutes. The server checks expiration, installation, publication, ownership and permissions on every call.

// Backend: keep the grant in memory; never log it.
const response = await fetch(context.session.endpoint, {
  method: 'POST',
  headers: { Authorization: `Bearer ${context.session.token}`, 'Content-Type': 'application/json' },
  body: JSON.stringify({ operation: 'transcript:read', meetingId: context.meetingId })
});
const result = await response.json();

Renew with await elo.request('session'). Configuration grants cannot read meeting transcripts; /config handles identity/preferences only. Never forward Elo login cookies.

Hosting and data

Allow embedding with Content-Security-Policy: frame-ancestors https://dash.elomeet.app. Do not send X-Frame-Options: DENY. Elo's sandboxed iframe has no camera, microphone or geolocation access.

Render text with textContent or a sanitized renderer, never transcript HTML. Log correlation, operation, status and elapsed time only; exclude tokens, full email addresses, transcripts and notes. Server-side revocation applies even while the iframe stays open.

Team security

Teams may require plugin installation approval. Selecting the team in the consent dialog creates a request without installing automatically. After approval, the user confirms installation. The API checks policy again when issuing a session and on every meeting operation; a personal installation cannot bypass team policy. A team_plugin_approval (403) response means a review must be requested. Removing a member or rejecting a previously approved request revokes new operations.

Team transcripts may be encrypted. Plugins use the same authorized API and receive readable text; they never receive team private keys. Protect logs and external copies in your infrastructure.