Embed panel & settings
The Embed button in the workspace toolbar opens the dialog that holds everything about deploying a questionnaire: the embed snippets and the two per-questionnaire settings (allowed origins and submission policy). Renaming, by contrast, lives on the questionnaire list.
Copy-ready snippets
Section titled “Copy-ready snippets”Three snippets, each with a copy button, pre-filled with this
questionnaire’s public id and your backend’s browser-facing URL: plain
HTML (the <forms-engine> tag plus its script include), React
(<FormsEngine>), and Angular (<forms-engine-embed>). They are the same
minimal mounts documented in Embedding.
One thing the snippets don’t include: an external-ref. If you set the
submission policy to one-per-reference (below), remember to add it —
without one the embed shows a configuration error by design.
Allowed origins
Section titled “Allowed origins”Which websites may load and submit this questionnaire, one origin per
line — e.g. https://app.example.com (scheme + host, optional port, no
path). Validation happens on save: entries must be well-formed origins,
and * is rejected because an empty list already means “any origin” —
the dialog shows a warning badge when the list is empty so you can’t
mistake openness for protection.
Enforcement is server-side per request: mutating calls from a disallowed origin are rejected outright, and reads withhold the CORS header so browsers block them. See Origins & content security for the embedder’s view.
Submission policy
Section titled “Submission policy”How repeat submissions from the same external reference are handled:
- Multiple (default) — anyone can submit any number of times; a supplied reference is stored for correlation and filtering only.
- One per reference — one completed response per reference. Starting or completing a second one is rejected once a completed response exists for that reference; the embed then shows an “already submitted” state. In-progress responses never block anything, so an abandoned draft can’t lock someone out.
Choosing one-per-reference surfaces the honesty warning right in the dialog: the reference comes from your page’s markup, so anyone editing the page can change it. It deduplicates cooperative users (e.g. logged-in users of your own app); it is not suitable for contests, votes, or any adversarial setting. The full trust analysis: External references.
Each of the two settings has its own Save button — closing the dialog without saving discards edits to that section.
Address autocomplete note
Section titled “Address autocomplete note”The dialog also reminds you that address questions geocode through the backend’s proxy, which defaults to Photon’s public (fair-use) instance — self-host Photon for production traffic.