Private previews work inside your own site's iframe

Set an iframe's src to a preview's urlWithToken: the link keeps its token for your site alone, a paused sandbox shows its waking page in the frame and reloads by itself, and a public preview skips its warning page when it is framed. See previews.