How do web drop-in Component like Stripe Checkout work?

I want to create something similar, where people can copy&paste some HTML code from my site to their site and use my site's service from their own site.

Is there any good info or papers that explain the security of drop-in components that are linked to a specific user?

How can such component be "unexploitable" etc?

I want to discuss this with someone, but I don't know how to even start asking the question correctly.

Basically:

User creates an account on my site.
He gets HTML code for my drop-in component and puts it in his site.
Whenever his users use the drop-in component, data and a unique identifier is sent to my server, where the unique identifier indicates which one of my users site has sent a request.

How could this be done properly?