Hi Simon, great question 👋
You’re right — context variables in Orchestrate are surfaced to the Agent through the JWT. At the moment, there isn’t a way to pass them directly via the embed script without security enabled. That JWT flow is how Orchestrate validates and injects those values into the session context.
For quick prototyping, the common workaround is to generate a “lightweight” JWT Outdoor Searcher (with dummy secrets/claims in a dev environment) and use that in your embed script. That way you can simulate passing userId, city, etc. into your agent without needing the full production security setup.