Known footguns
Trailing slash on frameOrigin
Mint compares exact strings.https://your-app.example.com/ will fail if the allowlisted origin is https://your-app.example.com.
Mutable embed URLs
Never load/chart/latest. Pin /chart/v<semver>/index.html. A directory URL (/chart/v<semver>/) will not load the chart.
TOKEN_KEY_UNKNOWN
If you see this error, pin a newer embed version.postMessage targetOrigin
Always pass the embed CDN origin topostMessage. Using * defeats origin checks on the parent side.