Take sign ups on one site and programmatically create user accounts on a sub domain

by

I would do it these way:

  1. Create api on subdomain ( user registration, may be some checks for is email registred atc. )
  2. When on primary domain user has payed and filled out form – send these data to api ( on subdomain ), check, register, or alter an error.
  3. On primary domain you can echo eny data from api on subdomain ( just needs an api call to return data ).

Back to your question: eny solution has a holes, aldought i’m not an expert, but with iframe you give more space to work with ( for some bad guys ), but with api u have calls, wich u can check and throw an errors is fomething not right.

Whait for someone, more familiar, with security issues to answer )