On the guests end it to has event handler that listens for "message", this can be seen here https://github.com/cityindex/dashboard-app/blob/master/app/scripts/kibana-custom.js#L29

It the calls onMessage which can be seen here https://github.com/cityindex/dashboard-app/blob/master/app/scripts/kibana-custom.js#L7

Then when it sends messages back in https://github.com/cityindex/dashboard-app/blob/master/app/scripts/kibana-custom.js#L13 it uses the origin and source to check the identity.

I think I have this correctly setup, there is not much documentation on the Chrome Apps docs, however it does mention the API is identical to https://developer.mozilla.org/en-US/docs/Web/API/Window.postMessage