I find the easist way to do this is to set up most of the code (and test it with a string literal) and then use ACF to load the unique part (ID, verfication code etc)
If you can get your iframe working hard-coded then swap out the changing parts for variables generated from CF fields
