The iframe flow from the
official Lakaut guide,
end to end: a session token brokered server-side, a sample PDF handed over in
lakaut.init, and the signed result verified against its published
SHA-256 before it downloads.
A sample PDF rides along in the init. After the handshake you can swap in your own — 10 MB max, PDF only.
The embed loads here once a session starts.
Your backend brokers the token; the browser only ever sees a 30-minute session.