Web Embedding (iframe)

How to embed an XCover Journey in an iframe on your website.

Add an iframe to your page with the journey URL:

<iframe
  id="xcover-journey"
  src="https://sandbox.xcj.xcover.com/acme-travel/en/"
  style="width: 100%; height: 800px; border: none;"
></iframe>

Replace acme-travel with your partner slug and update the language and country codes for your integration. When going live, switch the URL from sandbox.xcj.xcover.com to xcj.xcover.com.

Domain allowlisting

If your site uses a Content Security Policy (CSP), ensure that xcj.xcover.com (and sandbox.xcj.xcover.com for testing) is allowed in your frame-src or child-src directive. Without this, the browser will block the iframe from loading.

Sandbox attribute

If you use the sandbox attribute on the iframe, include these values to avoid breaking the journey:

sandbox="allow-scripts allow-forms allow-popups allow-same-origin"

• allow-scripts — the journey is a JavaScript application
• allow-forms — customer data entry and payment forms require form submission
• allow-popups — authentication flows may navigate to external domains from within the iframe
• allow-same-origin — session storage requires same-origin access

Omitting any of these will break the journey.