Embed the studio

Create sessions from your backend with POST /v1/embed-sessions.

Choose a mode

Mode	Capabilities
edit	Scene status, optional source image, viewport, and multi-turn editing
perform	Viewport, camera and lens controls, controllers, and recording
edit_and_perform	Both workflows in one session

Mode is immutable. The parent page cannot elevate a session through query parameters or postMessage.

Create the session

{
  "sceneId": "scene-id",
  "origin": "https://partner.example",
  "mode": "edit_and_perform",
  "expiresInSeconds": 3600,
  "theme": {
    "partnerName": "Partner",
    "accentColor": "#7657ff",
    "colorScheme": "dark",
    "helpText": null
  }
}

Production origins must be exact HTTPS origins approved during onboarding. Approved test organizations may use exact http://localhost:<port> origins. Session lifetime must be between 300 and 86,400 seconds.

The complete returned URL is a bearer secret. Keep it out of logs and analytics and deliver it through an authenticated response with Cache-Control: private, no-store.

Mount a native iframe

No Smore package or script is installed in the parent application.

<iframe
  id="smore-studio"
  title="Scene camera studio"
  allow="gamepad; hid; fullscreen"
  referrerpolicy="no-referrer"
  sandbox="allow-scripts allow-same-origin allow-pointer-lock allow-forms"
></iframe>

Minimum container sizes:

• perform: 640×360
• edit or edit_and_perform: 960×600

Register your message listener before assigning src. Validate both event.origin === "https://embed.smore.video" and event.source === iframe.contentWindow.

Content Security Policy

The parent page needs:

Content-Security-Policy: frame-src https://embed.smore.video

If the parent sends a restrictive Permissions Policy, delegate gamepad, hid, and fullscreen to the embed origin.

Revoke

Call DELETE /v1/embed-sessions/{embedSessionId} when the user cancels or the session should no longer be usable. The route is idempotent and existence-hiding.