# Scenario 2: a client logs in (/docs/embed/client-logs-in)

A client who already has a website (from sign-up or the one-off migration) signs in and opens the page. Nothing is created: your server only asks for a link.

<Tabs items={['Diagram', 'API calls']}>
<Tab value="Diagram">

<EmbedFlow only="login" />

</Tab>
<Tab value="API calls">

### 1–2. Your sign-in, exactly as today [#12-your-sign-in-exactly-as-today]

`POST /login` and your own session cookie. There is no Happierleads login to add, and we never see your session.

### 3–7. Your page asks your server for a one-time link [#37-your-page-asks-your-server-for-a-one-time-link]

Your page calls **your** endpoint. Your server checks the user is signed in, reads `company.happierleadsWebsiteId` from **your** database (never from the request), and asks us for a link with your embed key:

```js title="server.js"
app.get('/api/leads-embed', requireLogin, async (req, res) => {
  const r = await fetch(`${process.env.HL_API_BASE}/v3/embed/sessions`, {
    method: 'POST',
    headers: { Authorization: `Bearer ${process.env.HL_EMBED_KEY}`, 'Content-Type': 'application/json' },
    body: JSON.stringify({ websiteId: req.user.company.happierleadsWebsiteId, view: req.query.view || 'auto' }),
  });
  if (!r.ok) return res.status(502).json({ error: 'Could not open this screen' });
  res.set('Cache-Control', 'no-store').json({ url: (await r.json()).url }); // works once, 60 seconds
});
```

The call to us, from your server only, with your embed key. Try it on sample data (change `view`, or send another `websiteId` to see the refusal); the **JavaScript** and **Python** tabs have the server code:

<ApiPlayground method="post" path="/v3/embed/sessions" tool="" args={`{ "websiteId": "64b7f0a1c2d3e4f5a6b7c8d9", "view": "auto" }`} />

Every field and `view`: [Open a screen](/docs/embed/open-a-screen).

### 8. Their leads appear [#8-their-leads-appear]

```html
<iframe id="hl" title="Website visitors" style="width:100%;height:100%;border:0"></iframe>
<script>
  fetch('/api/leads-embed?view=leads').then((r) => r.json()).then(({ url }) => { document.getElementById('hl').src = url; });
</script>
```

The screen stays open as long as your Session length (1 week by default), then sends `session-ended`: load a fresh link. More: [Show it in an iframe](/docs/embed/iframe).

</Tab>
</Tabs>