Drupal Forge Token Lets Editors Embed Demos Without Full HTML

Website editors can embed interactive demonstrations in restricted Drupal text fields without granting authors Full HTML access when the site's text filters are configured appropriately. Darren Oh, volunteer project lead at Drupal Forge, explained the token-based approach in a blog post published on 21 October 2026, following October updates to the Drupal Forge Token module.

The integration allows documentation, training and marketing sites to place launchers for cloud-hosted demonstrations directly alongside their content. Rather than requiring authors to insert custom HTML elements and JavaScript, Drupal Forge Token generates the necessary launcher markup from a short text token. Administrators can retain restrictions on the HTML that content authors submit while allowing the module to generate the launcher during content processing.

The module works with the contributed Token Filter module to replace recognised tokens in formatted text. Authors can enter [drupalforge:71], where 71 identifies a Drupal Forge demonstration template. Token replacement generates a webform-component element and attaches the launcher's JavaScript library, which the installed module serves from the Drupal site.

The order of Drupal's text filters determines whether that generated element remains in the rendered page. The module's documentation recommends placing token replacement after the filters that restrict permitted HTML and correct faulty markup. This allows Drupal to process author-submitted HTML before the token provider introduces the launcher element. If token replacement runs before HTML restriction, the generated element may be removed unless the filter explicitly permits it and its required attributes.

A restricted text format can therefore exclude directly submitted script tags and launcher elements while still supporting demo tokens. Administrators must enable the appropriate filters and configure their processing order. They must also manage text-format permissions and consider other token providers made available through the same format.

The embedding mechanism received updates during October 2026. Drupal Forge Token 1.0.2, released on 14 October, introduced an iframe relay for authenticated API requests and an option to isolate launcher styles using Shadow DOM. Version 1.0.5, released on 19 October, corrected link styling affected by the embedding site's theme. Shadow DOM style isolation helps prevent styling conflicts but does not provide a separate JavaScript security boundary.

Serving the launcher JavaScript through the installed module reduces the need for authors to include an externally hosted script manually. It does not remove the integration's dependence on Drupal Forge infrastructure. The published requirements specify HTTPS for sign-in, compatible browser cookie settings and appropriate Content Security Policy permissions for external frames and network requests. Administrators must account for these requirements when deploying launchers on sites with restrictive browser security policies.

The demonstration template is selected through its numeric identifier. The module's published instructions explain how to find and embed these identifiers but do not describe a separate editorial approval workflow for individual templates. Sites that need to restrict demonstrations to an approved selection should establish their own review and publishing procedures.

The module is also connected to a proposed Drupal.org integration. During a July 2026 interview with The DropTimes, Darren discussed using token-based trial widgets on Drupal.org documentation, marketing and project pages. The proposal is referenced in Drupal.org issue #3490328. The module provides an embedding mechanism for such pages, although the proposal should not be treated as evidence that the integration has been deployed on Drupal.org.