liforma docs

Browser embeds (allowed origins)

Client-side session minting protected by an origin allowlist.

What this is

A browser embed lets the SDK mint a Session Manifest from the client. Your site sends its Origin header; Liforma checks that origin against your allowed origins list. No API key runs in the browser.

Allowed origins authorize which websites may start a session from the browser. They exist so third parties cannot embed your experience (which you pay to run) on a site you did not approve.

When to use

  • You want client-only integration — no server route to mint sessions
  • Marketing pages, demos, simple education embeds, iframes
  • You can allowlist every production origin that will host the embed

If you have a backend, prefer server sessions with an API key — stronger control, per-user context, and the key never leaves your server.

Integration

Svelte

<script>
  import { Experience } from '@liforma/client/svelte';
<\/script>

<Experience experienceId="exp_01DEMO1SPANISHCAFE" />

React

Use @liforma/client/react. In Next.js, mark the file 'use client'.

Demo.tsx
import { Experience } from '@liforma/client/react';

export function Demo() {
  return <Experience experienceId="exp_01DEMO1SPANISHCAFE" />;
}

Web component

For Vue, Angular, plain HTML, or tools that only accept custom elements:

<script src="https://cdn.liforma.ai/sdk/v2/client.js"><\/script>

<liforma-experience experience-id="exp_01DEMO1SPANISHCAFE"></liforma-experience>

Requirements

  1. Enable browser embeds for the project in app.liforma.ai
  2. Add every site origin that will host the embed to the Origins allowlist
  3. Pass experienceId to the SDK component
  4. Browser must support required APIs (Web Speech API for voice input)

What the SDK does

  1. Reads experienceId from your component
  2. Calls POST /v1/public-sessions with the page Origin header (endpoint name is historical — this is the browser mint path)
  3. Receives a Session Manifest if the origin is allowlisted
  4. Starts the runtime — no API key on your server

Security model

Experience IDs (exp_…) are not secret. Protection comes from origin allowlists, short-lived session tokens, quotas, and billing — so a third party cannot burn your minutes by embedding your experience elsewhere.

Billing

Browser-minted sessions are still metered per minute. See pricing.