The embeddable player page (loaded by the @alakazamworld/embed SDK iframe)
Serves the embed page for a world by slug. With a valid LIVE-mode session token (?token=), the page nests the streaming player full-viewport and emits Content-Security-Policy: frame-ancestors bound to the token’s origin / the app’s registered embedding origins (default-deny ‘none’). Test-mode tokens render a sandbox handshake page. Not a JSON API — an HTML document; listed here because integrators point iframes at it.
Path Parameters
Query Parameters
Session token from POST /v1/sessions/token.
The embedding page's origin (the SDK sets this automatically).
base64-encoded JSON theme tokens (the SDK sets this from createEmbed({theme})).
Response
The embed HTML page (live player, sandbox preview, or invalid-token notice).
The response is of type string.

