Im not sure if this is actually possible, but I want to have an external website with an Iframe of a Snap! project and have it run javascript code in the project. this is usually blocked by cross origin policy so I think it is probably impossible but I wanted to ask anyway.
unfortunatly I don't think it can do what i was wanting. still cool though!
Snap! is ready to be "remotely controlled" with the postMessage described in the API document.
So COORS is not an issue until you want some unusual pattern.
but can the api run arbitrary javascript in the Snap! window using postMessage?
No.
You can load a project from the Snap! cloud or modify Snap! in your browser with user scripts.
yeah that's what i thought. :(
can you tell us what you are trying to accomplish?
this site isn't really related but consider this when posting
ok, I want to make a website that has a Snap! project embedded in it, and I want to be able to either toggle javascript extensions or whitelist extension urls in the project.
But what is the real problem? 
Why do you want to toggle JS extensions or whitelist extension urls?
Why Isn't running your own fork of the Snap! code with JS extensions enabled by default good enough?
I have a project that I want embedded in a website and I want to be able to have the project run js code.
Those are the two ways to allow a project to run unofficial js code in Snap!
I don't know much about this, but I assume it would have to be updated to each new Snap! version. It could work though if there is no other way to accomplish this.
You can make a copy of the Snap! code and upload it to your own website and then simply change the JS enabled flag to true (currently at line 610 in threads.js)
To keep it current with Snap! you would have to update it but only really required to do that on a major version change
Ok, I did that and it works, but are these a problem?
You can't load projects from Snap Cloud if your site is not whitelisted by Snap Dev.
Be cautious; you may be IP banned for unauthorized access to the cloud backend.
so what do I change to make it not try to access the Snap Cloud?
First of all, you will not get ip banned if you leave the cloud on. Those errors were not by trying to get a project from the cloud, they were instead just trying to initialize the cloud connection. I've left the cloud on on my snap mod for a long time, and I have not been banned.
Second, to turn off the cloud, go into `src/gui.js" and find
this.cloud = new Cloud();
Then under that line, just add this
this.cloud.disable();
That's all you need to do to disable the cloud.
that works, thanks!