The iframe is created after sportsbook.js loads so iframeReady / postMessage handlers register in time. The iframe URL is built server-side with proper encoding. If you use a non-production Nexus stack, set NEXXUS_SPORTSBOOK_IFRAME_ORIGIN to match your sportsbook web UI origin.