Skip to main content
This feature is available in our paid editions. Contact us here, and we'll be delighted to assist you!
Before you provision users and generate signing keys, complete the embed onboarding in Platform Settings → Security → Embedding. On Cloud, all four steps below are required. On self-hosted Enterprise, only steps 3 and 4 apply — your instance already runs on your own domain.
1

Step 1: Enter the embed URL (Cloud only)

Pick the subdomain you’ll embed in your website (e.g. flows.acme.com). This URL will be visible inside workflows and is the origin the iframe loads from.Enter the embed URL
Use a subdomain you control. You’ll need access to its DNS provider in the next step.
2

Step 2: Verify the DNS records (Cloud only)

Add the records shown in the dashboard at your DNS provider. They cover hostname routing, ownership, and SSL. We detect them automatically — verification usually completes within a few minutes.Verify the DNS records
If you see two _acme-challenge TXT records with different values, both must be in place for SSL to issue. If your DNS provider supports multiple records with the same name, add both at once. If it only allows a single record per name, add one first — once it verifies and disappears from the dashboard, add the second.
Once all records are detected, the domain status switches to Active and you can move on.
3

Step 3: Add allowed websites

List the origins that are allowed to load your embed in an iframe (e.g. https://app.acme.com). All other origins are blocked by the browser.Verify the DNS records
You can also pre-seed origins via the AP_ALLOWED_EMBED_ORIGINS environment variable on self-hosted instances. Origins set this way are merged with the ones configured in the UI.
4

Step 4: Add a signing key

Generate the signing key used to authenticate users. This step is covered in detail in Provision Users.