Put a buy button on your own site, blog or docs. The checkout opens in an overlay on their page — the customer never leaves it. List the sites allowed to do that; nothing else on the internet can frame your checkout, and neither can anything at all until you add one.
One origin per line — scheme and domain, no path. Any page on the site may embed. Remove the last one to switch the embed off entirely.
No sites allowed yet, so the embed is off and its URL answers 404.
Publish a product and its snippet appears here.
The real checkout, framed exactly as a visitor's browser frames it.
Allow at least one site and pick a published product to see the preview.
Affiliate referrals are not tracked through an embed: the referral cookie belongs to your store's own address, and browsers block third-party cookies inside a frame. The sale completes normally, it is simply unattributed. Visitor analytics are not collected inside the frame either.
