Embed tokens

Issuance

POST /api/v1/embed/tokens
Authorization: Bearer mk_xxx
Content-Type: application/json

{
  "filters": {"host": "web-01"},
  "ttl_seconds": 600
}

Response:

{
  "token": "eyJ...",
  "expires_at": "2026-05-15T10:00:00Z"
}

Origin allowlist

The API key has an origin allowlist. A request with an Origin not in the list → 403.

Filters

They cannot be overridden via the URL. composeQuery takes filters from the JWT claims; optional ones from the URL can only add, not override.