Iframe environment - Startale Documentation

The Startale App embeds every Mini App in an iframe with a fixed sandbox and allow attribute. This page is the reference for those values. Your Mini App must work within them.

Sandbox

Mini Apps in the production catalogue are embedded with:

sandbox="allow-scripts allow-forms allow-popups allow-popups-to-escape-sandbox allow-same-origin allow-downloads"

Token	What it allows
`allow-scripts`	JavaScript execution.
`allow-forms`	Form submission.
`allow-popups`	`window.open` and `target="_blank"` links.
`allow-popups-to-escape-sandbox`	Popups open unsandboxed.
`allow-same-origin`	Your Mini App keeps its own origin.
`allow-downloads`	File downloads, including `<a download>` and Blob exports. See Files and sharing.

Permissions Policy (`allow`)

allow="clipboard-read; clipboard-write; camera; microphone; web-share"

Each directive is delegated to your Mini App’s own origin only, never to a wildcard.

Directive	What it allows
`clipboard-read`, `clipboard-write`	`navigator.clipboard`.
`camera`, `microphone`	`getUserMedia`. Follow the flow in SDK actions.
`web-share`	`navigator.share()`. See Files and sharing.

What is blocked

Blocked	Why	What to do instead
`alert`, `confirm`, `prompt`, `window.print()`	`allow-modals` is not granted.	Use an in-page `<dialog>`, which works regardless of the sandbox.
Navigating the top window	`allow-top-navigation` is not granted.	Use `sdk.actions.openUrl()` to open external links in a new tab.
Cookies	The frame is third-party to `app.startale.com`.	See Storage.
Storage Access API	`allow-storage-access-by-user-activation` is not granted.	Use `localStorage` or `IndexedDB`.

Preview versus catalogue

The developer preview frames any URL you enter. It uses the same sandbox as the production catalogue, so file downloads work there, but its allow list does not include web-share:

	Catalogue	Developer preview
`sandbox`	includes `allow-downloads`	includes `allow-downloads`
`allow`	includes `web-share`	no `web-share`

navigator.share() fails in the developer preview and works in production.