> ## Documentation Index > Fetch the complete documentation index at: https://docs.amlok.io/llms.txt > Use this file to discover all available pages before exploring further. # Embed the Integrations Hub > Embed the Integrations Hub, obtain borrower consent, validate session messages and connect authorized sources for underwriting and ongoing monitoring. AMLOK's Integrations Hub collects borrower authorization and connects sources selected by the institution in the console. Your backend creates a borrower-bound session; your frontend displays its short-lived launch URL. AMLOK performs collection and normalization. ## Publish and discover a Hub In **Embeddings**, publish the integrations, branding and requested consent purposes. Approve exact HTTPS embedding origins and return URLs. AMLOK rejects wildcard origins, embedded URL credentials, fragments and unregistered destinations. Sandbox alone may permit explicitly registered loopback HTTP origins for development; Live requires HTTPS. Read `GET /v1/configuration`. Each embedding\_versions entry lists its ID, integrations, consent purposes, allowed origins, return URLs and hub\_origin. Publishing a new version does not change existing sessions. Use a version whose integration set and purposes fit the borrower flow. ## Create the session on your server Authenticate your own customer and authorize their relationship to the borrower before calling `POST /v1/embedding-sessions`. Keep the API key on the server. Send borrower\_id, embedding\_version\_id, purpose, return\_url, consent\_purposes and, for an iframe, embed\_origin. * Request credit\_assessment for underwriting. * Request continuous\_monitoring for post-funding monitoring. * Request both if the borrower is explicitly consenting to both. The Hub presents both purposes; neither implies the other. * Requested purposes must be a subset of the published Hub's allowed purposes. Otherwise return 422 consent\_purpose\_missing. * For reauthorization, use purpose reauthorize and the affected connection\_id. Consent can be renewed only with a new affirmative borrower authorization. The session expires at expires\_at. Repeating the same idempotency key returns the same session, including its original expiry. After expiration create a new session with a fresh command identity. An abandoned session is never evidence of consent. ## Display the borrower experience Use launch\_url for either full-page navigation or an iframe. A session without embed\_origin is redirect-only. The Hub uses a frame-ancestors policy allowing the approved parent origin; API endpoints do not enable browser CORS for secret keys. Allow the configured hub\_origin in your application's frame-src policy. ```html theme={null} ``` Set the iframe source from your own authenticated backend response. Never put an API key into HTML. Providers that require a new window open it only after a borrower action. If browser restrictions prevent completion, offer a borrower-initiated full-page link to the same unexpired launch URL. The Hub persists the session's confirmed connections across these presentations. The [browser example](https://docs.amlok.io/downloads/hub-embed.js) uses the typed HubMessage contract. Every message contains protocol\_version, event\_id, session\_id and type. Types are amlok.hub.ready, amlok.hub.completed, amlok.hub.cancelled, amlok.hub.expired and amlok.hub.failed. The Hub sends messages only to the exact embed\_origin, never `*`. Validate event.origin against the configured hub\_origin, event.source against the iframe's contentWindow, and session\_id against the session your backend created. Deduplicate event\_id. No message includes provider tokens, financial data or proof of consent. Your backend retrieves the session before trusting a terminal state. For full-page presentation, terminal states return the browser to the approved return\_url with amlok\_session\_id and amlok\_state added as query parameters. These reserved parameters cannot be supplied in the configured URL. Treat them as untrusted hints; your authenticated backend verifies session ownership and retrieves its state. Cancelled and expired sessions require a new session. Already confirmed consent/connections are not revoked by closing the window. ## Confirm readiness The completed state means the borrower finished the Hub journey, not that all sources have finished ingestion. Retrieve session.connection\_ids and consent\_ids. A connection exposes authorization status separately from data\_status, freshness and coverage. Wait for required inputs or let an origination remain collecting; never interpret a stale or partial source as a clean result. An underwriting-only connection cannot enroll in Signal. Create a new authorization session requesting continuous\_monitoring, then use the resulting connection IDs. Reauthorization preserves the logical connection ID when the same source account is reconnected. A different source creates a different connection. ## Resolve a resource requirement When an origination or monitor returns requires\_action, use its typed requirements. Create a Hub session with that resource's origination\_id or monitor\_id and requirement\_id. These IDs must match the borrower and an open connect/reauthorize requirement. On successful authorization, AMLOK atomically associates the connection, resolves that requirement, increments the resource version and schedules permitted continuation. The immutable submitted\_request and historical results remain unchanged. For an independently connected source on an existing monitor, replace connection\_ids using the monitor's If-Match configuration update. This change is prospective. Hub configuration stays in the console; the API does not expose provider job orchestration. This documentation is built and hosted on [Mintlify](https://mintlify.com), a developer documentation platform.