Profile embeds
Public and unlisted profile cards can be embedded using their current profile slug. Private profiles are not available through the public embed endpoint.
<iframe
src="https://api.vrchatlegends.com/api/players/PROFILE_ID/embed"
title="VRChat Legends profile"
width="380"
height="280"
loading="lazy"
style="max-width:100%;border:0;background:transparent"
></iframe>
Replace PROFILE_ID with the profile's current slug. For a durable integration, store its permanent user ID and resolve the current profile before rendering a link.
Sharing a profile URL in Discord also allows Discord to read its metadata. Cached previews may take time to update after an image or title changes.
Content sections and counters
The following read-only HTML endpoints use the same profile ID and visibility rules. Prefix paths with https://api.vrchatlegends.com/api/players/PROFILE_ID.
| Suffix | Content | Suggested starting height |
|---|---|---|
/embed | Profile card and profile link | 280px |
/embed-worlds | Featured worlds | 380px |
/embed-avatars | Avatar links | 380px |
/embed-groups | Group links | 380px |
/embed-videos | Profile videos | 420px |
/embed-gallery | Gallery images | 420px |
/embed-comments | Read-only profile comments | 420px |
/embed-like | Like count and profile link | 64px |
/embed-views | View count and profile link | 64px |
Set a descriptive iframe title, choose a height for the content you show, and keep its width responsive. Comments and likes are performed on the website, not through these display-only iframes. Never put an API key in an embed.
const iframe = document.createElement('iframe');
iframe.src = 'https://api.vrchatlegends.com/api/players/'
+ encodeURIComponent(profileId) + '/embed-worlds';
iframe.title = 'Featured VRChat worlds';
iframe.width = '420';
iframe.height = '380';
iframe.loading = 'lazy';
iframe.style.cssText = 'max-width:100%;border:0;background:transparent';
document.querySelector('#profile-worlds').append(iframe);
Use profile API writes from a trusted server when building your own editor. A public embed should never ask visitors to paste a website session credential.