SpreadSpace runs as a tab on each loan in your loan origination system, with no separate login, no data sync and no redirect. Integrating the API or the embedded workspace takes a day, and a coding agent can write most of it.
Your server mints a short lived handle for the loan and the signed in user, your page renders the workspace from it, and the loan links itself the moment the first document arrives. The embed and the upload webhook are the two pieces, and a skill file lets a coding agent write both.
The embedded workspace carries the same controls as the workspace itself, so an analyst working inside your loan page has the canvas, the source drawer, the counterparty board and the memo builder. The workspace is unbranded and bundled with the cost of extraction.
When the analyst finalizes a spread inside the frame, your backend receives an event naming the snapshot and reads the approved figures by id straight into your own fields. If the spread is reopened, a second event marks your copy stale until the next finalize.
Two packages cover it. A server package mints a single use handle for one loan and one surface, and a React package renders the workspace from that handle in an iframe served from SpreadSpace. The token that authorizes the session is exchanged inside the frame and never reaches your page.
Uploads flow from the loan's inbox through a webhook to an intake endpoint that resolves the borrower and the loan from your own reference. A repeat upload of content already extracted is answered as a duplicate rather than processed twice.
A test mode key runs the whole loop against an isolated sandbox at no charge, with seeded borrowers and loans, so the integration is proven before a live document is touched.
Your page never holds a SpreadSpace token. A handle is single use, expires in seconds and is worthless off SpreadSpace's origin. The session token is locked to one loan, so a leaked token cannot reach other loans or mint further tokens, and only the pages you list may frame the surface.
The embed scope on your server side key is the control point. Revoking it severs every issued token and every in flight handle at once. Writes are granted per session and stay bound to that loan.
Pass your own identifier for the viewing user and SpreadSpace keeps that person's board arrangements, preferences and memo templates across sessions and devices. The same identifier comes back on the finalized snapshot, so your backend can say who finalized from its own user table. SpreadSpace never needs a person's name from your service.
A credit officer configures the add-backs your policy allows with a credit policy write scope on their API key, and every spread in the embedded workspace follows it. Memo templates are company wide, and spread templates and board arrangements follow each analyst by the identifier you pass, so the frame on your loan page is the same workspace for everyone who opens it.
A day. Your server mints a handle, your loan page renders the workspace from it, and a webhook forwards uploads from the loan inbox. The docs carry a skill file so a coding agent can write both halves.
No. The handle your server mints is single use and expires in seconds, and the session token is exchanged inside the iframe and stays there.
One loan, for the lifetime of the session, with only the writes that session was granted. It cannot mint further tokens, and revoking the embed scope on your key severs every token at once.
When an analyst finalizes, your backend receives an event naming the snapshot and reads the approved figures by id. A reopen sends an event so you can mark your copy stale.
Yes. The controls, the canvas, the source drawer, the counterparty board and the memo builder are the same. The frame has no navigation rail of its own because your page provides it.
Yes. A test mode key runs every step against an isolated sandbox with seeded borrowers and loans, and nothing is billed.
No. The workspace is unbranded inside your page and bundled with the cost of extraction.