# Reference

Source: https://ceyo.ai/docs/signal/embedding-reference

### Security

**Server-side key**

Store the Signal API key in backend secrets. Never place it in HTML, browser code, logs, or client bundles.

**Short-lived token**

Give the browser only a short-lived embed session token and renew it through your authenticated backend.

**User scope**

Mint each session for the signed-in user and intended project. Validate authorization before creating the session.

**HTTPS**

Serve the host application over HTTPS in production.

**Allowed host origins**

Add each HTTPS origin that hosts the embeddable to every API key used to create or refresh its sessions. Those keys must use the same `allowed_origins`, for example `https://app.partner.example`. Configure only origins you control; Signal service origins are handled automatically.

**Cleanup**

Call `unmount()` when a single-page application removes the host view or signs the user out.

### Troubleshooting

**Target not found**

Mount after the container exists, or pass the DOM element directly.

**Session rejected**

Confirm the backend used the correct project and external user, and that the user has access to the requested scope.

**Locked session**

Implement `onTokenExpired` and ensure it returns a fresh token from your backend.

**Empty view**

Verify that the project contains data and the session user can access the expected project or locations.

**Layout issues**

Give the host container enough width and set an explicit component height.

**Localization fallback**

An `invalid_localization` error lists missing, empty, or invalid message keys. Start from `Ceyo.translationTemplate()`, preserve interpolation variables such as `{{count}}`, and mount again with the corrected catalog.

**Handshake debugging**

The iframe sends `ceyo:ready`, `ceyo:token_expired`, and `ceyo:error`. The loader replies with `ceyo:init` and replacement `ceyo:token` messages. Both sides validate the message source and origin; use the loader instead of posting messages directly.

**Runtime error**

`onError` receives one human-readable message string. Capture that message, then inspect the browser console and failed network response for structured API details and a request ID.