Hey @Backofficely! Thanks for reaching out.
There is a pretty good page in our documentation about authenticating users in embedded apps and generally passing data between parent and child, but I'll summarize below.
The first and simplest way to authenticate users in an embedded app is to set up both the React and Retool apps to authenticate with the same SSO provider. If the parent application uses a different authentication method, then we instead recommend generating a pre-authenticated single-use URL via the Retool API. Note that both of these methods require features that are scoped to the Enterprise plan, meaning they won't be viable solutions for all users.
The last option, which can't be considered truly secure, is to pass data about the current user from the React app to the Retool app via the data parameter. The Retool app can read this data via a special "Parent Window" query.
I hope that helps! You can read more about everything I shared here in the doc that I linked initially. Let me know if you have any follow-up questions, as well. 