> ## Documentation Index
> Fetch the complete documentation index at: https://docs.startale.com/llms.txt
> Use this file to discover all available pages before exploring further.

# Iframe environment

> The exact sandbox and Permissions Policy attributes the Startale App puts on your Mini App iframe, what they allow, and what stays blocked.

The Startale App embeds every Mini App in an iframe with a fixed `sandbox` and `allow` attribute. This page is the reference for those values. Your Mini App must work within them.

## Sandbox

Mini Apps in the production catalogue are embedded with:

```
sandbox="allow-scripts allow-forms allow-popups allow-popups-to-escape-sandbox allow-same-origin allow-downloads"
```

| Token | What it allows |
| - | - |
| `allow-scripts` | JavaScript execution. |
| `allow-forms` | Form submission. |
| `allow-popups` | `window.open` and `target="_blank"` links. |
| `allow-popups-to-escape-sandbox` | Popups open unsandboxed. |
| `allow-same-origin` | Your Mini App keeps its own origin. |
| `allow-downloads` | File downloads, including `<a download>` and Blob exports. See [Files and sharing](/miniapps/capabilities/files-and-sharing). |

## Permissions Policy (`allow`)

```
allow="clipboard-read; clipboard-write; camera; microphone; web-share"
```

Each directive is delegated to your Mini App's own origin only, never to a wildcard.

| Directive | What it allows |
| - | - |
| `clipboard-read`, `clipboard-write` | `navigator.clipboard`. |
| `camera`, `microphone` | `getUserMedia`. Follow the flow in [SDK actions](/miniapps/sdk-actions#actions-requestcameraandmicrophoneaccess). |
| `web-share` | `navigator.share()`. See [Files and sharing](/miniapps/capabilities/files-and-sharing). |

## What is blocked

| Blocked | Why | What to do instead |
| - | - | - |
| `alert`, `confirm`, `prompt`, `window.print()` | `allow-modals` is not granted. | Use an in-page `<dialog>`, which works regardless of the sandbox. |
| Navigating the top window | `allow-top-navigation` is not granted. | Use `sdk.actions.openUrl()` to open external links in a new tab. |
| Cookies | The frame is third-party to `app.startale.com`. | See [Storage](/miniapps/capabilities/storage). |
| Storage Access API | `allow-storage-access-by-user-activation` is not granted. | Use `localStorage` or `IndexedDB`. |

## Preview versus catalogue

The [developer preview](/miniapps/testing#preview) frames any URL you enter. It uses the same `sandbox` as the production catalogue, so file downloads work there, but its `allow` list does not include `web-share`:

| | Catalogue | Developer preview |
| - | - | - |
| `sandbox` | includes `allow-downloads` | includes `allow-downloads` |
| `allow` | includes `web-share` | no `web-share` |

`navigator.share()` fails in the developer preview and works in production.


This documentation is built and hosted on [Mintlify](https://mintlify.com), a developer documentation platform.