/embed. WebMCP is not an embedding mechanism—it registers tools so a browser agent can drive the top-level World Monitor site, while embed routes explicitly expose no WebMCP tools. Use /embed (or the loader below) to pull an allowlisted panel into another product.
Copy-paste loader
Partners should ship one script tag. The loader creates the iframe and posts the embedding account’s API key after load. Never put the API key in the iframe URL.YOUR_WM_API_KEY with a World Monitor user API key (wm_…) or enterprise key from the embedding account. Rotate that key independently of dashboard login. Query-string keys are rejected.
Public live map (no key):
Allowlisted panels
Unknown
panel values do not render. X / tweet-body panels are not embeddable: partners receive derived facts plus permalinks only, never post text.
Iframe (live map)
The map remains available as a direct iframe. Omittingpanel keeps the historical map-only contract.
/embed?panel=fear-greed, but the partner page must postMessage { source: "worldmonitor-embed", type: "credential", key } to the frame after it loads. Prefer the script loader.
Query parameters
Loader
data-* attributes:
Entitlement
Keyed panels check the embedding account, not the person viewing the host page:- The iframe fetches
/api/embed/entitlement?panel=withcredentials: 'omit'andX-WorldMonitor-Key. - Viewer cookies and anonymous
wms_session tokens are ignored. - Enterprise keys in
WORLDMONITOR_VALID_KEYSand user keys (wm_) whose owner hasfeatures.apiAccessare accepted. - Use the dashboard Embed button to generate a snippet for the current public map view.
