Frame Embedding#

Required roles: AIS Map Frame Access — Roles
Base endpoint: https://ais-map.ibosoft.net.tr/
Reference documents: none
Attribution: show ibonav.aero wherever this data is displayed
Data sources: see the ibonav.aero User Guide; each layer's source is shown in the map's attribution
Last updated: 18 OCT 2026

Depending on your use, the original data sources may also need to be credited.

This page embeds the complete ibonav.aero Interactive Map. If you only need the map tiles or the aeronautical data (to show them in your own map or application), see the Tile Server (Layer Lists) and Geo Server sections instead.

Frame embedding puts the complete ibonav.aero Interactive Map into your page with an <iframe>: the same map, panels and tools as on the ibonav.aero website, with no map code on your side. Your page only has to supply an API access token to the map.

Use it when you want the full map as it is. If you need to control the map from your own code (add your own layers, change defaults, react to the map), use SDK embedding instead.

1. Get an access token on your server#

Every data request of the map (tiles, geo server, MET, NOTAM …) carries an API access token. Your server gets this token; the long-lived personal token never goes to the browser.

1. On your account at https://auth.ibosoft.net.tr, the responsible person needs the AIS Map Frame Access (ais-data:map-frame) role. In the ibonav.aero - API & Data Access card they create a personal API token (ibp_…). Keep it on your server only.

2. Your server exchanges the personal token for a 1-hour access token:

   POST https://auth.ibosoft.net.tr/api/gateway/token
   Authorization: Bearer ibp_...
   

   { "success": true, "token": "...", "expires_in": 3600, "roles": [] }
   

3. Give your page an endpoint of your own (e.g. /my-server/ais-map-token) that returns { token, expires_in } from this call.

Details of tokens and roles: Authorization.

2. Add the iframe#

<iframe id="ais-map"
        src="https://ais-map.ibosoft.net.tr/"
        title="ibonav.aero Interactive Map"
        allow="geolocation; fullscreen; clipboard-write"
        style="width: 100%; height: 600px; border: 0;"></iframe>

• src may carry query strings to set the opening view, layers or a chart, e.g. https://ais-map.ibosoft.net.tr/?mapSetCenter=32.85,39.93&mapLayersAdd=atsairspace_ctr.
• allow: geolocation for the My location tool, fullscreen, clipboard-write for the copy buttons. Leave out what you do not want to allow.
• The map works only inside a frame. Opened directly in the address bar, https://ais-map.ibosoft.net.tr answers 403.

3. Pass the token to the map#

The map and your page talk with postMessage:

<script>
  var MAP_ORIGIN = 'https://ais-map.ibosoft.net.tr';
  var frame = document.getElementById('ais-map');
  var renewTimer = null;

  function getToken() {
    // Your own server endpoint (step 1). Returns { token, expires_in }.
    return fetch('/my-server/ais-map-token', { method: 'POST' })
      .then(function (r) { return r.json(); });
  }

  function sendToken() {
    getToken().then(function (t) {
      frame.contentWindow.postMessage(
        { type: 'ais-map-auth', token: t.token, expires_in: t.expires_in, roles: [] },
        MAP_ORIGIN                       // send only to the map
      );
      clearTimeout(renewTimer);
      // Send a fresh token about 5 minutes before this one expires.
      renewTimer = setTimeout(sendToken, Math.max(30, t.expires_in - 300) * 1000);
    }).catch(function () {
      clearTimeout(renewTimer);
      renewTimer = setTimeout(sendToken, 30000);
    });
  }

  window.addEventListener('message', function (event) {
    if (event.origin !== MAP_ORIGIN) return;              // only the map
    if (!event.data || event.data.type !== 'ais-map-auth-request') return;
    sendToken();
  });

  frame.addEventListener('load', sendToken);
</script>

Points to keep:

• Check the origin of incoming messages and send the token only to the map origin (second argument of postMessage), never to '*'.
• The map accepts the token message only from its direct parent window.
• On renew: true, do not resend a cached token; get a new one from your server.
• Cache the token on your server for its lifetime instead of requesting a new one for every page view (see Rate Limits).

Roles and locked features#

The roles field unlocks the map's own role-locked controls. Roles are carried only by the tokens of ibonav.aero member sessions; a token obtained with a personal API token has no roles, so send roles: [].

With roles: [], the following stay locked (shown with a lock icon) on your page:

• Google Earth and HGM base maps
• NATO TFC / SAC charts
• Surveillance (ADS-B) and live ATC broadcasts

Everything else, including D-ATIS / DCL in the aerodrome ATC tab, is available. Role locks cannot be changed in frame embedding; to offer Surveillance or ATC broadcasts on your site, use SDK embedding with the matching developer roles.

Settings saved by the map#

The map stores the viewer's preferences (layers, dimmer, projection, last position) in the browser storage of https://ais-map.ibosoft.net.tr. In a frame, browsers may keep this storage separately per embedding site, or block it in private mode; the map then starts from its defaults. Query strings are applied at every opening and are never saved.