# Allow a website

**POST** `/api/embed/v1/websites`

Allows a website to show every customer’s embed.

Needs a partner key: `Authorization: Bearer gre_…`, from [Platform › Partner keys](https://docs.gorunner.io/embed/platform-screens#partner-keys). Call it from your server only.

Embed · Self-hosted with an Embed license

## Parameters

### Headers

- `Idempotency-Key` · Optional · string: Up to 255 characters. The same request with the same key within 24 hours answers the first result again, with `Idempotency-Replayed: true`.

### Body

- `origin` · Required · string: `https://` and a host, with an optional port. `https://*.bakery.example` covers every subdomain of a domain you own.

## One customer’s own website

For a website that should show only one account, use [Allow a website for one account](https://docs.gorunner.io/embed/api/websites/add-account-website).

## Responses

- 201 Created

  Added, as stored. It applies the next time the embed loads.

- 400 `VALIDATION_ERROR`

  The body isn’t a JSON object, or `origin` isn’t text.

- 409 `WEBSITE_EXISTS`

  The list already has it.

- 409 `CONFLICT`

  A request with this `Idempotency-Key` is still running. Retry shortly.

- 422 `INVALID_ORIGIN`

  It can’t be allowed as written. The message says why.

- 422 `TOO_MANY_WEBSITES`

  The list already has 200.

- 422 `VALIDATION_ERROR`

  This `Idempotency-Key` was already used with a different request.

- 500 `INTERNAL_ERROR`

  Something failed on the installation’s side. Try again.

Any call can also answer: [`401 UNAUTHORIZED`](https://docs.gorunner.io/errors#UNAUTHORIZED) · [`403 EMBED_NOT_LICENSED`](https://docs.gorunner.io/errors#EMBED_NOT_LICENSED) · [`403 IP_NOT_ALLOWED`](https://docs.gorunner.io/errors#IP_NOT_ALLOWED) · [`413 PAYLOAD_TOO_LARGE`](https://docs.gorunner.io/errors#PAYLOAD_TOO_LARGE) · [`415 INVALID_CONTENT_TYPE`](https://docs.gorunner.io/errors#INVALID_CONTENT_TYPE) · [`429 RATE_LIMITED`](https://docs.gorunner.io/errors#RATE_LIMITED) · [`503 BUSY`](https://docs.gorunner.io/errors#BUSY). See [Errors](https://docs.gorunner.io/embed/api#errors).

Request

**curl**

```bash
GORUNNER="https://automations.example.com"
GORUNNER_EMBED_KEY="YOUR_PARTNER_KEY"  # gre_…

curl -X POST "$GORUNNER/api/embed/v1/websites" \
  -H "Authorization: Bearer $GORUNNER_EMBED_KEY" \
  -H "Idempotency-Key: $(uuidgen)" \
  -H "Content-Type: application/json" \
  -d '{
    "origin": "https://app.bakery.example"
  }'
```

**JavaScript**

```js
const GORUNNER = "https://automations.example.com";
const KEY = process.env.GORUNNER_EMBED_KEY; // gre_…

const res = await fetch(
  `${GORUNNER}/api/embed/v1/websites`,
  {
    method: "POST",
    headers: {
        Authorization: `Bearer ${KEY}`,
        "Idempotency-Key": crypto.randomUUID(),
        "Content-Type": "application/json",
      },
    body: JSON.stringify({ origin: "https://app.bakery.example" }),
  },
);
const { data } = await res.json();
```

**Python**

```python
import os, uuid, requests

GORUNNER = "https://automations.example.com"
KEY = os.environ["GORUNNER_EMBED_KEY"]  # gre_…

res = requests.post(
    f"{GORUNNER}/api/embed/v1/websites",
    headers={
        "Authorization": f"Bearer {KEY}",
        "Idempotency-Key": str(uuid.uuid4()),
    },
    json={
      "origin": "https://app.bakery.example",
    },
)
data = res.json()["data"]
```

Response · 201 Created

```json
{
  "data": {
    "origin": "https://app.bakery.example"
  }
}
```

**Every field**

### Body

- `origin` · Required · string: An origin: `https://` and a host, an optional port, nothing after it.

### Response · 201 Created

- `data` · object
  - `origin` · string

Related: [Stop allowing a website](https://docs.gorunner.io/embed/api/websites/remove-website) · [List allowed websites](https://docs.gorunner.io/embed/api/websites/list-websites)

Source: https://docs.gorunner.io/embed/api/websites/add-website