Token minting

POST /api/v1/embed/chart-sessions

Auth

Bearer API key with embed:chart permission. Session cookie auth is not supported for this route.

{ "frameOrigin": "https://your-app.example.com" }

frameOrigin must exactly match an allowlisted origin (bare origin, no trailing slash). Ask Headlight to add your origin before you mint.

{ "token": "...", "expiresInSeconds": 300 }

The token is a short-lived JWT. Public keys ship in the pinned embed bundle.

The chart requires a valid token to render. Your page origin must be allowlisted.