CB login authentication token

I have a last question on this autoaction. The decrypt is made by 

No triggers
User : code
Code : Conditions : active subscriptions for plans A & B
Action : PHP include (JPATH_ROOT.'/myfolder/file.php');
Output : return
Reference : var1

This works fine to display file.php and get the user data on an external website.

But when displaying the same file.php on our own website, it seems that the correct user is not retrieved.

To cope with this, I'd like to pass the user_id got by the autoaction in my code. However, if I access [var1_id] this is the id of the user visiting the page, not the user of the autoaction.

How can I get the user retrieved by the autoaction  and pass it to my code ? 
II remember that you have a way to send the autoaction data now but cannot retrieve the doc

Thanks for this final answer on this subject I hope

So if there's no [get_token] you want to return the current viewing user? Check if there's a token then return the viewing user using the below API.

CBuser API
MyUser API
Either of these will work. CBuser API call has the benefit of giving the full user object to work with if you need access to more than just their user id in your custom user code.

No I don't want the current viewing user but the user from whom the code was triggered in order to display its data.

It seems to work fine outside on other domains where the iframe is displayed , but when it's displayed on our own, it seems that the token is not correctly decrypted and this is either the viewing user or the main super admin user which is used

That's why I was searching a solution to keep the initial user id associated with the token

It shouldn't matter what domain you're on. Make sure &token is set correctly when testing on your own domain. The token is the user id. It decodes to it. Sorry, there's nothing more I can suggest. This is far outside our support scope.

Well the token is very well decrypted on all external domains but not on ours.

Anyway, is there an ability to restrict the autoaction to our own domain ? I cannot remember what value is needed for this ?

This would allow me to have a code for external domains with a token and another one with user ids on our domain.

External access should be entirely handled by your origin policy for your site. CB Auto Actions cannot do that for you. The only hacky workaround would be checking the referrer, but that's easily spoofed so do not do that.

Maybe try a different encryption method instead of using Joomla's API. I didn't create that API so I've no idea if it has some sort of same origin check.