Embedding the editor

Here you set up what your developers need to open the HotLayout editor inside your own admin panel: the allowed domains, the key and the count of people.

What embedding is#

With embedding the editor opens on a page of your back-office instead of in the HotLayout admin. Your people sign in to your own system and do not need a HotLayout account or a second password.

It works like this:

Your developers load the editor from our domain and place it on a page.
When a person opens that page, your server asks HotLayout for a one-time ticket for them. It does this with the embedding key. The ticket lives one minute and works once.
The page hands the ticket to the editor, and the editor opens.

The developer side is described in the integration guide, under Embedding the builder. This page covers the part that you, as an owner or an admin, set up in the admin.

Open the page#

In the admin, open Embedding in the menu of the organization. Only an owner and admins can use it. Other members see a note that embedding is managed by the owner and the admins.

If your plan does not include embedding, the page says Not in your plan: embedding is part of the Embedded plan, and there is nothing to set up until it is added. Use the contact link on that page to add it.

If the licence has ended, the page says so and keeps your settings. Until the licence is valid again, every sign-in through embedding is refused.

Allowed domains#

In Allowed domains you list the websites where the editor may open. It opens only on pages whose address is on this list.

Type the address into the Domain field. Write the exact origin: the scheme, the host and the port if there is one, with nothing after it. For example https://admin.example.com, or http://localhost:3000 while your developers work on it.
Press Add.

Rules:

There are no wildcards and no subdomain patterns. https://admin.example.com and https://app.example.com are two entries. A different port is a different entry too.
http is accepted only for localhost.
You can paste the address as it looks in the browser's address bar: capital letters, a trailing slash, the default port (:443) and a non-Latin name are converted to the form the browser sends.
A path (https://admin.example.com/editor) is not an origin; the page tells you so.
An organization can have up to 20 domains.

To take a website off the list, press Remove next to it. The editor stops opening there.

If someone else changed the list while you were on the page, your change is not saved and the page shows what is stored now. Check it and repeat the change.

The list protects in one specific way: a ticket is accepted only from a page of a listed domain, and only once. It does not make a ticket secret. Your server decides who gets a ticket.

Embedding key#

The key is the password of your server to HotLayout. With it, your server asks for tickets.

In Embedding key, press Create a key.
The key is shown in a window. Press Copy the key and put it into the secrets of your server.
Press I have saved it.

The key is shown only once. It stays on the screen until you confirm that you saved it, and it is gone when the tab is closed. Nobody can read it again, not even you. If it is lost, replace it.

Treat the key as a master key: whoever holds it can open the editor as any of your people. Keep it only on the server, never in the code of a page or an app.

Replace the key makes a new key and asks you to confirm. The old key stops working at once, so your server is refused until it uses the new one, and tickets already issued with the old key stop working too. People who are already in the editor stay in it until their session ends (up to 8 hours); to cut them off at once, remove them under Members.
Turn off also asks to confirm. The key stops working at once and nobody can sign in through embedding until you create a new one. Tickets already issued stop working too, and people who are already in the editor stay until their session ends (up to 8 hours).

People and sessions#

People and sessions shows who uses the editor through embedding.

A line like "People in the editor: 3 of 25" says how many people count towards the plan and what the limit is. When the number is a lower bound, the line says "at least". Press Refresh to read it again.
A person counts when they opened the editor with Edit or Publish access in the last 30 days. People with View access do not count.
Recent sessions lists the latest sessions: who, with what access (View, Edit or Publish), and from which domain. A ticket that was issued but not opened yet is marked "ticket not used". If the last attempt to open the editor was refused, the row says so and gives the reason, for example a domain that is not allowed or no seats left in the plan.

Who gets which access is decided in your system: your server names the level when it asks for the ticket. HotLayout never gives more than Publish.

When the limit is reached, a new person is refused until a seat frees up. People who are already counted keep their access. Removing a person from the members list does not free the seat at once: it frees itself 30 days after their last editing session. To raise the limit, write to the HotLayout team (see Trial and licence).

People from embedding in the team list#

On the Team page, people who came through embedding have the mark "via embedding". They show the name your system gave them, or its id, because they have no email. Their role comes from your system on every sign-in: viewer, editor or publisher.

Changing their role in the HotLayout admin does not stick, and removing one of them lasts only until their next sign-in. To change their access, change it in your system. See Team and roles.

If something does not work#

The person who opens the editor sees "Could not start the editor session" and the reason. The most common ones:

The website is not on the list of allowed domains: add it in Allowed domains, exactly as the browser shows the address.
The licence is not active or does not include embedding.
The limit of people is reached.
The ticket from the page is unknown, used or expired. This is for your developers; tickets work once and for one minute.

The developers find the full list of reasons in the integration guide.