Legacy (unsigned) mode

An older, origin-allowlist based embed path. Kept working for existing integrations only.

How it works

Origins listed in Designa's build-time allowlist may load an embed page without partnerId/sigat all. There is no per-user identity or signature to verify — Designa trusts the request purely because it's loaded from a recognized origin.

What's different from signed URLs

• No partnerId, sig, or any of the signed URL parameters are required.
• The session defaults to the admin role.
• The credit pool is namespaced by origin instead of a real partnerBusinessId.
• No real account is provisioned — the session is a synthetic, origin-scoped session rather than a Keycloak-backed account.

Should you use it?

No, unless you already have an existing integration that predates signed URLs. Every capability of legacy mode — including a shared credit pool — is available on the signed path with a real per-user identity, and the signed path is what the Quickstart and Authentication guides describe.