Deployed on a real external domain. This is the only place the security model can
actually be tested — the check runs on the browser-set Referer of the
/embed/v1 request, which a local file never produces.
| This page's origin | |
| Key under test | |
| Referrer policy | |
| Iframe URL | not created yet |
Swap the key with ?k=pk_live_…. The page never hard-codes a live key.
A rejected origin and a misconfigured partner look identical from this page —
/embed/v1 returns an empty 204 for all of: malformed key, unknown key,
active: false, tier: "free", and origin rejected.
So "nothing rendered" alone does not prove the origin check fired.
Confirm in Base44 → Security that an origin_rejected event was written for this
origin. No event means it failed for one of the other reasons — check the partner's tier first.