Everything inside a teal frame is a real Nash widget in a cross-origin iframe. Everything else — the nav, the filters, the ERP table — is host chrome this page renders itself. Selection, filters and ETAs cross the boundary as messages; the console below records every one of them. The page ships with no data: you point it at your own organization.
Four steps, all in your own Nash Portal. Use an organization that holds synthetic data only — never one with real deliveries.
— to that
organization's Allowed origins
(same Settings → Widgets page). Nash checks it on every mint and
refuses everything without it; skipping this step is why a first
attempt looks broken.
dlv_… delivery ids from the same
organization, then Apply — one real mint verifies the setup
before the page commits to it.
Allow-list this origin first. In your Nash
Portal, add under Settings →
Widgets → Allowed origins. Nash verifies it on every mint and
refuses everything without it, so a credential from an
organization that has not done this renders nothing here — that
is the check, not a fault in the demo. There is no default
organization: leave the field empty only to keep a credential
already active in this tab.
Held for this tab only — sessionStorage plus a session cookie the token endpoints read — and gone when the tab closes. It never appears in a URL, in the page bundle, in the protocol inspector, or in any response body.
Ids must belong to the credential's organization — Nash denies
anything else with a uniform FORBIDDEN at mint. Your
set is saved in this browser only (localStorage, plus a cookie
the token endpoints read) and never appears in a URL. Applying
verifies the combination with one real mint, then creates the
widgets so fresh sessions seal it.