Token minting

POST /api/v1/embed/chart-sessions

Auth

Bearer API key with embed:chart permission. Session cookie auth is not supported for this route.

{ "frameOrigin": "https://your-app.example.com" }

frameOrigin must exactly match an entry in EMBED_ALLOWED_FRAME_ORIGINS (bare origin, no trailing slash).

{ "token": "...", "expiresInSeconds": 300 }

Tokens are Ed25519 JWTs with kid in the header. Public keys ship in the pinned embed bundle.

Metering and licensing. Framing is enforced by CSP frame-ancestors, which the browser applies regardless of client-side verification.