You have to use the non iframe version of the published build (e.g https://playcanv.as/e/p/YhVutmbe/) Notice the extra e in the URL.
The reason for this is that the normal published build link is wrapped in an iframe of its own so you end up with an iframe in iframe issue and therefore can’t post a message in the right window instance due to it crossing domains from CodePen to PlayCanvas.
The extra e gives you un frame app so it can be embedded directly into a webpage and post messages without crossing domains.