Go-live checklist

Run through this before you point real users at your integration.

• Serve your integration over HTTPS in production

  Designa's session cookie is SameSite=None; Secure; Partitioned, which silently fails to persist over plain HTTP. Local http://localhost testing will not behave like production — test on a real HTTPS deployment before signing off.

• allowed_origins matches your real production domain(s) exactly

  Check this on your partner record — mismatches are one of the most common causes of a broken embed after launch.

• embed_secret is stored server-side only

  Confirm it isn't in any client bundle, public repo, or log output. If in doubt, rotate it.

• Tested with a real email address per user

  Designa provisions a real account per email — test accounts with throwaway addresses can behave differently.

• Your postMessage listener checks event.origin

  Before trusting event.data, confirm event.origin === "https://app.designa.ai".

Full technical reference: /developers/authentication, /developers/embeddable-pages, /developers/events.