Skip to main content
Embed bootstrap tokens are bound to an origin allowlist stored on your firm. Tradara snapshots the list when you call POST /v1/firm-control/embed-sessions and enforces it at POST /v1/auth/embed/exchange.

​
What to list

Add the Tradara terminal origin — the scheme and host where /embed is served:
Do not list your own website (https://portal.acme.example). The exchange Origin header comes from the iframe document (the terminal), not the parent page framing it.
Origins are matched on scheme://host (port included when non-default). Paths are ignored.

​
Set via PATCH firm

Update firm metadata with an allowed_embed_origins string array. Merge with existing metadata keys you already use.
In the Tradara Backoffice, open Firm Control, select your firm, and use the Embed tab to manage allowed origins and the embed theme without calling the API directly.
Requires firm admin write permission (staff JWT or a key with the appropriate firm-control scope).

​
Verify

Confirm metadata.allowed_embed_origins is a non-empty array before minting embed sessions. Mint calls return 400 firm has no allowed_embed_origins configured when the array is missing or empty.

​
Local development

If you run the terminal dev server on a non-production host, include that origin as well:
Coordinate with your Tradara onboarding contact before adding non-production origins to production firm records.