> ## Documentation Index
> Fetch the complete documentation index at: https://docs.agentcard.sh/llms.txt
> Use this file to discover all available pages before exploring further.

# Embed origins

> The web origins allowed to iframe the wallet embed.

**Embed origins** are the sites permitted to frame the Agentcard wallet embed (the Wallet SDK's `frame-ancestors`). The list is configuration, not a credential: origins end up verbatim in a public CSP header. It is empty by default, in which case the embed only renders inside Agentcard's own surfaces.

Origins must be HTTPS. `http://localhost` and other loopback hosts are allowed for local development. Anything with a path or query is reduced to its origin.

## The embed origins object

| Field     | Type      | Description                                                                                                     |
| --------- | --------- | --------------------------------------------------------------------------------------------------------------- |
| `object`  | string    | `embed_origins`                                                                                                 |
| `origins` | string\[] | The full allowlist, normalized to bare origins. Empty means the embed renders only on Agentcard's own surfaces. |

```json theme={null}
{ "object": "embed_origins", "origins": ["https://app.example.com", "http://localhost:3000"] }
```

## Endpoints

| Endpoint                    |                                                           |
| --------------------------- | --------------------------------------------------------- |
| `GET /api/v2/embed_origins` | [Get embed origins](/api-reference/embed-origins/get)     |
| `PUT /api/v2/embed_origins` | [Replace embed origins](/api-reference/embed-origins/put) |