Try to implement it in a way that makes sense for non-technical users. Existing platforms like Disqus and Facebook comments probably offer good examples.
Some more authentication options:
- the client site becomes a DiscourseConnect client. This is straightforward to implement, but requires added server side code to the client site.
- users authenticate on the client and their auth status is passed to the iframe with the postMessage API: Window: postMessage() method - Web APIs | MDN
- users login directly to Discourse via the iframe
My reluctance to developing this purely on the client side came from considering the problems of the system working at any kind of scale. Essentially, I was having to queue API requests and handle responses from queued requests. It didn’t feel robust enough to deal with, say 1000 concurrent users. I’d have similar concerns, but for different reasons with the javascript embed approach. I suspect it would be much easier to deal with than trying to synchronize everything on the client though.