Understand the integration
The embed route accepts a template identifier and website key. The host can listen for export events. Check event origins and validate message data before acting on it; never embed a bearer API key.
Review the production boundary
Treat a website key as a limited rendering capability, not as a private server secret. Review who can use it, which templates are reachable and how exports affect your allowance. Expanded production embed scopes and controls remain part of the platform roadmap.



