From a73caf69ff0f74b8e906d1c940bc06cd4817b419 Mon Sep 17 00:00:00 2001
From: =?UTF-8?q?Greg=20Berg=C3=A9?= <berge.greg@gmail.com>
Date: Mon, 16 Feb 2026 12:48:02 +0100
Subject: [PATCH] Allow to pass a token to the embed script (#4005)

---
 .../[siteData]/~gitbook/embed/script.js/route.ts | 16 ++++++++++++++--
 1 file changed, 14 insertions(+), 2 deletions(-)

diff --git a/packages/gitbook/src/app/sites/static/[mode]/[siteURL]/[siteData]/~gitbook/embed/script.js/route.ts b/packages/gitbook/src/app/sites/static/[mode]/[siteURL]/[siteData]/~gitbook/embed/script.js/route.ts
index be51d24e1..7801d5d17 100644
--- a/packages/gitbook/src/app/sites/static/[mode]/[siteURL]/[siteData]/~gitbook/embed/script.js/route.ts
+++ b/packages/gitbook/src/app/sites/static/[mode]/[siteURL]/[siteData]/~gitbook/embed/script.js/route.ts
@@ -24,10 +24,22 @@ export async function GET(
 (function () {
   const w = window;
   const gb = w.GitBook;
+
+  function getScriptSearchParams() {
+    const script = document.currentScript;
+    if (!script) return new URLSearchParams();
+
+    const url = new URL(script.src);
+    return url.searchParams;
+  }
+
+  const searchParams = getScriptSearchParams()
+  const token = searchParams.get('jwt_token');
   const initOptions = window.gitbookSettings || ${JSON.stringify(initOptions)};
+  const initFrameOptions = token ? { visitor: { token } } : undefined;
 
   if (typeof gb === "function") {
-    gb('init', initOptions);
+    gb('init', initOptions, initFrameOptions);
   } else {
     var d = document;
 
@@ -40,7 +52,7 @@ export async function GET(
     };
     w.GitBook = g;
 
-    g('init', initOptions);
+    g('init', initOptions, initFrameOptions);
 
     const load = function () {
       const style = document.createElement('link');