v149 · Permissions Policy · Security

Header Builder

Build the exact Permissions-Policy HTTP header and the corresponding iframe allow attribute for focus-without-user-activation. Choose an allowlist mode, add specific origins, and get copy-pasteable output for your server and your embed tags.

Allowlist mode

* — allow all origins (default for most policies; no restriction)

'self' — allow same origin only; all cross-origin iframes are blocked

() — block all origins including self (most restrictive)

Custom list — allow specific origins plus optionally 'self'

Allowed origins

'self'

HTTP response header

iframe allow attribute

nginx / Apache config snippet

implementation reference

Need the exact API surface, compatibility boundaries, errors, lifecycle, and source links? Read the matching gendn reference ↗

see also

implementation reference