Embedding

Allowed origins

5 min

Limit which parent websites may load the embed. Pass embed_domain from the host (the SDK sets this automatically). Empty allowlists are rejected.

Why it matters

Origin allow lists reduce misuse if a link is copied.

How to use

  1. Open embed settings.
  2. Add only the sites you operate (full origins, e.g. https://app.example.com).
  3. Remove old staging domains when finished.
  4. Retest from the allowlisted host.

Success check: Unknown sites cannot validate the token or load live tile data.

Next steps