diff --git a/demo/index.html b/demo/index.html
index a1dccab..9f21909 100644
--- a/demo/index.html
+++ b/demo/index.html
@@ -14,29 +14,101 @@
         color: red;
         margin-top: 1rem;
       }
-      #app {
-        min-height: 200px;
+      .code {
+        font-family: monospace;
+        font-weight: 600;
       }
     </style>
   </head>
   <body>
-    <h1>Airbyte Widget Demo</h1>
     <div id="app">
+      <h1>Airbyte Widget Demo</h1>
+      <p>
+        This is a demo application of the Airbyte Embedded widget. Make sure you have the following environment variables
+        set in <span class="code">/demo/.env</span> before running it:
+        <ul>
+          <li><span class="code">VITE_AB_ORGANIZATION_ID</span> - Your Airbyte organization ID</li>
+          <li><span class="code">VITE_AB_WORKSPACE_ID</span> - Your Airbyte workspace ID</li>
+          <li><span class="code">VITE_AB_CLIENT_ID</span> - Your Airbyte client_id</li>
+          <li><span class="code">VITE_AB_CLIENT_SECRET</span> - Your Airbyte client_secret</li>
+        </ul>
+      </p>
+      <p>This demo uses these environment variables to fetch and refresh a scoped access token for the widget. In a
+      production application, the <span class="code">client_id</span> and <span class="code">client_secret</span> should not be exposed to your web application.</p>
       <div id="loading" class="loading">Loading widget...</div>
       <div id="error" class="error"></div>
     </div>
     <script type="module">
-      import { EmbeddedWidget } from "@airbyte-embedded/airbyte-embedded-widget";
+      import { EmbeddedWidget } from "../src/EmbeddedWidget.ts";
 
       const loadingEl = document.getElementById("loading");
       const errorEl = document.getElementById("error");
 
+      async function getAdminToken() {
+        const response = await fetch("https://local.airbyte.dev/api/public/v1/applications/token", {
+          method: "POST",
+          headers: {
+            "Content-Type": "application/json",
+          },
+          body: JSON.stringify({
+            client_id: import.meta.env.VITE_AB_CLIENT_ID,
+            client_secret: import.meta.env.VITE_AB_CLIENT_SECRET,
+            "grant-type": "client_credentials",
+          }),
+        });
+        const { access_token } = await response.json();
+
+        return access_token;
+      }
+
+      async function getScopedToken() {
+        const access_token = await getAdminToken();
+        const response = await fetch("https://local.airbyte.dev/api/public/v1/embedded/widget?debug", {
+          method: "POST",
+          headers: {
+            "Content-Type": "application/json",
+            authorization: `Bearer ${access_token}`,
+          },
+          body: JSON.stringify({
+            workspaceId: import.meta.env.VITE_AB_WORKSPACE_ID,
+            organizationId: import.meta.env.VITE_AB_ORGANIZATION_ID,
+            allowedOrigin: window.location.origin,
+          }),
+        });
+        const token = await response.json();
+        return token;
+      }
+
       async function initializeWidget() {
         try {
-          new EmbeddedWidget({
-            token: import.meta.env.VITE_AB_EMBEDDED_TOKEN,
+          const overriddenToken = await getScopedTokenWithOverrides();
+          const widget = new EmbeddedWidget({
+            token: overriddenToken,
           });
 
+          async function getScopedTokenWithOverrides() {
+            const { widgetUrl, token } = await getScopedToken();
+            const originalWidgetUrl = new URL(widgetUrl);
+            const newWidgetUrl = new URL(
+              `${import.meta.env.VITE_AB_WEBAPP_URL}${originalWidgetUrl.pathname.toString()}?${originalWidgetUrl.searchParams.toString()}`
+            );
+            const newEncodedToken = btoa(
+              JSON.stringify({
+                widgetUrl: newWidgetUrl.toString(),
+                token,
+              })
+            );
+            return newEncodedToken;
+          }
+
+          async function refreshToken() {
+            const token = await getScopedTokenWithOverrides();
+            widget.updateToken(token);
+            console.log("Token refreshed:", token);
+          }
+
+          window.setInterval(getScopedTokenWithOverrides, 60_000);
+
           // Hide loading state on success
           loadingEl.style.display = "none";
         } catch (error) {
diff --git a/demo/package.json b/demo/package.json
index 87dfaf7..043b5f2 100644
--- a/demo/package.json
+++ b/demo/package.json
@@ -2,8 +2,7 @@
   "name": "airbyte-embedded-widget-demo",
   "private": true,
   "scripts": {
-    "dev": "vite",
-    "dev:local": "node scripts/dev.js",
+    "start": "vite",
     "test": "playwright test",
     "test:ui": "playwright test --ui"
   },
diff --git a/demo/scripts/dev.js b/demo/scripts/dev.js
deleted file mode 100644
index d069900..0000000
--- a/demo/scripts/dev.js
+++ /dev/null
@@ -1,106 +0,0 @@
-const { spawn } = require("child_process");
-const fs = require("fs");
-const path = require("path");
-const dotenv = require("dotenv");
-
-// Load environment variables from .env file
-const envPath = path.resolve(__dirname, "../.env");
-dotenv.config({ path: envPath });
-
-// Get or set default WEBAPP_URL from environment
-const WEBAPP_URL = process.env.AB_WEBAPP_URL || "https://local.airbyte.dev";
-console.log(`Using WEBAPP_URL: ${WEBAPP_URL}`);
-
-// Function to decode base64 (Node.js replacement for browser's atob)
-function atob(str) {
-  return Buffer.from(str, "base64").toString("binary");
-}
-
-// Function to parse and manipulate the embedded token
-function manipulateEmbeddedToken(token) {
-  try {
-    console.log("Intercepting and manipulating embedded token...");
-
-    // Make sure the base64 string is properly padded
-    const padded = token.padEnd(token.length + ((4 - (token.length % 4)) % 4), "=");
-
-    // Replace URL-safe characters
-    const base64 = padded.replace(/-/g, "+").replace(/_/g, "/");
-
-    const decodedToken = JSON.parse(atob(base64));
-
-    // Log original token data
-    console.log("Original widget URL:", decodedToken.widgetUrl);
-
-    // Extract and modify the widget URL
-    const originalWidgetUrl = new URL(decodedToken.widgetUrl);
-
-    const newWidgetUrl = new URL(
-      `${WEBAPP_URL}${originalWidgetUrl.pathname.toString()}?${originalWidgetUrl.searchParams.toString()}`
-    );
-
-    decodedToken.widgetUrl = newWidgetUrl.toString();
-
-    console.log("Modifying token with admin token from .env");
-    // Allow optionally overriding the embedded scoped token with an instance admin one
-    decodedToken.token = process.env.VITE_AB_ADMIN_TOKEN ?? decodedToken.token;
-
-    // Log the modified widget URL
-    console.log("Modified widget URL:", decodedToken.widgetUrl);
-
-    // Return the manipulated token
-    return btoa(JSON.stringify(decodedToken));
-  } catch (error) {
-    console.error("Error manipulating token:", error);
-    return token; // Return original token if there's an error
-  }
-}
-
-// Get the current embedded token
-const originalToken = process.env.VITE_AB_EMBEDDED_TOKEN || "";
-
-// Manipulate the token
-const manipulatedToken = manipulateEmbeddedToken(originalToken);
-
-// Create a temporary .env file with the manipulated token
-const tempEnvPath = path.resolve(__dirname, "../.env.local");
-const envContent = `VITE_AB_EMBEDDED_TOKEN="${manipulatedToken}"`;
-
-fs.writeFileSync(tempEnvPath, envContent);
-console.log("Created temporary .env.local with manipulated token");
-
-// Start the Vite dev server
-console.log("Starting Vite dev server...");
-const viteProcess = spawn("pnpm", ["dev"], {
-  stdio: "inherit",
-  shell: true,
-  cwd: path.resolve(__dirname, ".."),
-  env: {
-    ...process.env,
-    VITE_AB_EMBEDDED_TOKEN: manipulatedToken,
-  },
-});
-
-// Handle process exit
-process.on("SIGINT", () => {
-  console.log("Cleaning up...");
-
-  // Clean up temporary .env file
-  if (fs.existsSync(tempEnvPath)) {
-    fs.unlinkSync(tempEnvPath);
-    console.log("Removed temporary .env.local file");
-  }
-
-  viteProcess.kill("SIGINT");
-  process.exit();
-});
-
-viteProcess.on("exit", () => {
-  // Clean up temporary .env file
-  if (fs.existsSync(tempEnvPath)) {
-    fs.unlinkSync(tempEnvPath);
-    console.log("Removed temporary .env.local file");
-  }
-
-  process.exit();
-});
diff --git a/package.json b/package.json
index a0f0f87..f94f82a 100644
--- a/package.json
+++ b/package.json
@@ -45,5 +45,6 @@
     "onlyBuiltDependencies": [
       "esbuild"
     ]
-  }
+  },
+  "packageManager": "pnpm@8.6.12+sha512.1336b80b948efd7979218a33ba96d9e4d380e6578144f6319979977deec6e3fe2e0a444b864b3ce2b077dda8adc4d654fee32b9c31868f0acb92da0abcf8ea1c"
 }
diff --git a/src/EmbeddedWidget.ts b/src/EmbeddedWidget.ts
index e960455..57bd501 100644
--- a/src/EmbeddedWidget.ts
+++ b/src/EmbeddedWidget.ts
@@ -75,6 +75,7 @@ export class EmbeddedWidget {
         height: 800px;
         background: white;
         font-family: Inter, Helvetica, Arial, sans-serif;
+        font-size: 0;
       }
 
       .airbyte-widget-dialog::backdrop {
@@ -211,4 +212,16 @@ export class EmbeddedWidget {
   public open(): void {
     this.dialog.showModal();
   }
+
+  public updateToken(token: string): void {
+    this.decodedToken = this.decodeToken(token);
+    const iframeOrigin = new URL(this.decodedToken.widgetUrl).origin;
+    const message = { scopedAuthToken: this.decodedToken.token };
+
+    try {
+      this.iframe.contentWindow?.postMessage(message, iframeOrigin);
+    } catch (error) {
+      console.debug("Error sending updated token to iframe:", error);
+    }
+  }
 }
