Drop McNif into the product you already have.

<iframe id="mcnif" style="width:100%;border:0;min-height:600px" referrerpolicy="origin"></iframe>
<script>
  (async () => {
    const { token } = await fetch('/api/mcnif-embed-token').then(r => r.json())
    document.getElementById('mcnif').src =
      'https://crm.mcnifglobal.com/embed/contacts?token=' + encodeURIComponent(token)
  })()
</script>

const crypto = require('crypto')

const SECRET = process.env.EMBED_SIGNING_SECRET // the 128-hex per-tenant secret
const TENANT_ID = '8e12fc2c-a7b0-44ca-8b4d-5ef5a4715dc4'

function b64url(input) {
  return Buffer.from(input).toString('base64')
    .replace(/\+/g, '-').replace(/\//g, '_').replace(/=+$/, '')
}

function mintEmbedToken(user) {
  const now = Math.floor(Date.now() / 1000)
  const claims = {
    iss: 'tenant:' + TENANT_ID,
    sub: 'user:' + user.id,
    iat: now,
    exp: now + 900,                       // 15 min
    tenant_id: TENANT_ID,
    host_origin: 'https://admin.mcnifmv.com', // MUST be in EMBED_ALLOWED_ORIGINS
    user: {
      id: user.id,
      email: user.email,
      name: user.name,
      role: 'member',                     // member | senior | admin | owner
    },
    scope: ['contacts:read'],             // read→view, write→edit (RBAC still applies)
    embed: { view: 'contacts', filters: {} },
  }
  const header = b64url(JSON.stringify({ alg: 'HS256', typ: 'JWT' }))
  const body = b64url(JSON.stringify(claims))
  const sig = b64url(crypto.createHmac('sha256', SECRET).update(header + '.' + body).digest())
  return header + '.' + body + '.' + sig
}

// Expose to your own authenticated front-end only:
app.get('/api/mcnif-embed-token', requireYourAuth, (req, res) => {
  res.json({ token: mintEmbedToken(req.user) })
})