Returns a URL to load in an iframe, for the company the API token belongs to. Call it from your server on each page view: the link carries a single-use code that is redeemed when the page loads, so a cached page will serve a spent code to everyone after the first visitor.