---
title: "Embed tokens, MailKaro Docs"
description: "A publishable token (pk_live_…) scopes a workspace's plan and enabled features. You issue it from your MailKaro dashboard and pass it to the editor."
---

# Embed tokens

Embedding & plans

# Embed tokens

A publishable token (`pk_live_…`) scopes a workspace's plan and enabled features. You issue it from your MailKaro dashboard and pass it to the editor.

tsx

```
<EmailEditor token="pk_live_xxxxxxxx" project="marketing" />
```

## How enforcement works

On load, the editor calls `GET /embed/runtime?token=…&project=…`. The server runs the full validation chain and returns the **effective entitlements**:

- Token exists and is `active`.
- The request `Origin` is allowed (empty allow-list = any origin; else host must match or be a subdomain; `*.vercel.app` matches only subdomains; a port such as `localhost:5173` must match).
- Effective plan = the account's real plan, capped by the token's own expiry and the account's end date, a token never outlives its account.
- Effective features = **plan features ∩ the token's enabled features**.

Any failure resolves to the **free** editor. Nothing paid is ever unlocked client-side.

## Per-token feature scopes

Each token can enable a subset of its plan's paid features (grouped in the dashboard: AI, exports, editor tools, collaboration, assets, white-label, shared library, governance, SSO). A paid feature the token omits is forced off; requested features are always clamped to the plan, the server never trusts the client.

ℹ **Turning a capability on is a per-token checkbox you can change anytime**, like GitHub permission scopes. In the dashboard open a token, mark each feature `true`/`false`, and save; create-time and later updates work the same way and apply on the editor's next load. Two to know:

- **AI, two separate checkboxes**, both on **Pro, AI Pro & Enterprise**, never Free:
- **AI Helper**, the per-block "Improve with AI" (headings, text, HTML, …).
- **AI Assistant**, the whole-canvas conversational assistant. Turning it on** automatically includes** the AI Helper; you can also enable the Helper on its own.

On **AI Pro** the AI is provided by us, just check the boxes. On **Pro / Enterprise** you [bring your own AI token](https://mailkaro.com/docs/ai-setup); until it's wired the control shows **disabled**. (An AI-Pro customer may wire their own token too, then that request runs on *their* key and doesn't spend AI-Pro credits.)
- **White-label branding**, check it on to show *only* your own logo in the editor, with no "Powered by MailKaro" badge at all; off keeps the MailKaro badge.

## Token properties

|Field |Type |Default |Description |
|`duration` |"1w"|"1m"|"1y"|"never" |- |Validity window. |
|`allowed_domains` |string[] |- |Origin allow-list (empty = any). |
|`features` |MailkaroFeatureKey[] |- |Enabled paid features (clamped to plan). See [Plans](https://mailkaro.com/docs/plans). |
|`status` |"active"|"inactive" |- |Deactivate without deleting. |

Free includes one token; Pro and Enterprise raise the limit (default 5 per org).

## Frequently asked questions

What is an embed token?

A publishable key (pk_live_) that scopes a workspace's plan and enabled features. You issue it from your MailKaro dashboard and pass it to the editor.

What happens if the token is missing, invalid or expired?

The editor resolves to the free plan. Nothing paid is ever unlocked in the browser.

Can a token turn on a feature the plan does not include?

No. The effective features are the plan's features intersected with the features enabled on the token, so a request above the plan is clamped by the server.

Can I limit where a token works?

Yes. Set allowed_domains on the token. An empty list allows any origin, otherwise the request host must match or be a subdomain.

How many embed tokens does each plan include?

Free includes 1, Pro 5, AI Pro 10 and Enterprise 25.

Source: https://docs.mailkaro.com/embed-tokens