For Canva and Iframely
Embed guide
A buyer personalizes a widget, copies one link, and pastes it into a Canva website. Canva asks Iframely what that link is. Iframely reads the page and returns an iframe of the widget.
Each widget page publishes a link tag with rel="iframely app", an oEmbed discovery link, and a matching HTTP Link header. Widget pages do not send X-Frame-Options, and they allow any site to frame them.
Example link:
https://widgets.joyvastudio.com/w/fireworks?palette=gold
https://widgets.joyvastudio.com/w/stack
oEmbed for that link lives at /api/oembed?url= plus the encoded widget address. The response type is rich, and the HTML is a transparent iframe.
Iframely reviews a live domain before Canva will embed it. Submit the production domain with a few real widget links, this page, and the copy-paste embed code from the customizer. The widget background is transparent. Whether Canva keeps that transparency is checked by pasting an approved link into a Canva website. A link on localhost can be opened directly, but Canva cannot fetch it.