Hello Vivian,

This is dependent on whether you want it inan iframe or as a new tab. If it is as a new tab then definitely an SSO extension. If you want it as an iframe in online banking then here is documentation on that: https://docs.q2developer.com/guides/frontend_development/enhanced_sso.html

For either of them you control the security, so you are required to do your own due diligence. During code review one of the things Q2 looks for is security so we will look at that also and try and check for any holes. From what I can tell this looks like a secure way of doing it just make sure the api calls are done with the Python code and that the user only gets what is absolutely necessary to perform the operation.

Thank you,
Trey Teter