Signal API
Reference as MarkdownUse a clean Markdown version of this page with an agent or local tooling.

Security

Server-side keyStore the Signal API key in backend secrets. Never place it in HTML, browser code, logs, or client bundles.
Short-lived tokenGive the browser only a short-lived embed session token and renew it through your authenticated backend.
User scopeMint each session for the signed-in user and intended project. Validate authorization before creating the session.
HTTPSServe the host application over HTTPS in production.
Allowed host originsAdd each HTTPS origin that hosts the embeddable to every API key used to create or refresh its sessions. Those keys must use the same allowed_origins, for example https://app.partner.example. Configure only origins you control; Signal service origins are handled automatically.
CleanupCall unmount() when a single-page application removes the host view or signs the user out.

Troubleshooting

Target not foundMount after the container exists, or pass the DOM element directly.
Session rejectedConfirm the backend used the correct project and external user, and that the user has access to the requested scope.
Locked sessionImplement onTokenExpired and ensure it returns a fresh token from your backend.
Empty viewVerify that the project contains data and the session user can access the expected project or locations.
Layout issuesGive the host container enough width and set an explicit component height.
Localization fallbackAn invalid_localization error lists missing, empty, or invalid message keys. Start from Ceyo.translationTemplate(), preserve interpolation variables such as {{count}}, and mount again with the corrected catalog.
Handshake debuggingThe iframe sends ceyo:ready, ceyo:token_expired, and ceyo:error. The loader replies with ceyo:init and replacement ceyo:token messages. Both sides validate the message source and origin; use the loader instead of posting messages directly.
Runtime erroronError receives one human-readable message string. Capture that message, then inspect the browser console and failed network response for structured API details and a request ID.