Deploy it
Your Spaces app is a static page — host it anywhere, on your own branded origin. The verified Space runs on the Witbitz origin inside the embedded iframe, so the room key and plaintext stay off your page.
Get Started path: Vault Spaces → this → Verify it.
Host the page
Host your HTML on Cloudflare Pages, Netlify, S3, or your own server — no build step, no backend. Two CSP notes for your page:
- allow
script-srcfor the origin you load from (https://witbitz.chatforembed.js, or the SDK origin); - for the headless SDK, allow
connect-srcfor your Spaceendpoint(defaulthttps://api.witbitz.chat/v1/space).
That's it — the Space itself is served, verified, from the Witbitz origin inside the iframe.
If you host the Spaces app itself
If you host the Spaces app (rather than embedding the hosted one), embedding is off by default
(frame-ancestors 'self'); set SPACE_EMBED_ORIGINS to the origins allowed to frame it (embed).
Production notes for your tenant
You registered a tenant in Vault Spaces — that meters usage to you and is your identity on the
/v1 platform. When you go past the walkthrough:
- Keep a demo tenant. A demo tenant is real and works immediately, but auto-purges at its
expires_at. To make it permanent — same id and keys, no more expiry — upgrade it with an author coupon:bash curl -sX POST https://api.witbitz.chat/v1/tenant/upgrade \ -H "Authorization: Bearer wsk_…" -H "X-Author-Coupon: <code>"Or sign up non-expiring from the start —POST /v1/tenants/signup(X-Author-Coupon). No coupon? Email hello@witbitz.chat. - Owner-governed rooms — mandate admission tiers that are provably yours across every room your app creates: built, built and tested, not yet enabled in production (owner rule).
- A bespoke Witbitz-hosted app — instead of hosting your own page, Witbitz provisions your tenant its own
deployment: its own origin (
witbitz-spaces-<yourapp>.pages.dev), its own key vault (a separate sign-in origin that confines the room keys — the same architecture the first-party Spaces runs on), its own split-key ecosystem key, and your agent config baked in. Sign-in needs zero setup on your side — Google and email-code run through the central Witbitz auth service, minted as your origin. Your app version is yours: it doesn't silently change when the reference Spaces updates. Rooms are stamped to your tenant and split-key by default. Provisioned per tenant — email hello@witbitz.chat with your tenant id and app name. - The billed
/v1surface is invite-gated private beta; the demo tenant and the keyless/spaceruntime work openly (Platform API).
Next
- Verify it — confirm the deployed Space is exactly what it claims.
- Reference: Platform API (OpenAPI) · The SDK.
Machine-readable source: deploy.md · Generated 2026-08-29T18:46:30Z · build f3ff88cc · every doc in one fetch: llms-full.txt (HTML) · ← vault-spaces · verify →