Test your server

Before you open the page in a browser, run these four commands (replace shop.example.com with your app host). They exercise the same routes your page calls in step 3 and step 5 — if any command fails here, fix the server first; the iframe will not work until these endpoints respond correctly.

What each line should return

1. 1

   curl -s https://shop.example.com/api/config

   HTTP 200 and JSON on stdout, for example { "authOrigin": "https://auth.kie.la", "profileFields": […], … }. Confirms your server is up and exposes public embed settings. No cookie required. If you get connection refused or 502, the app is not listening or crashed at startup.

2. 2

   curl -s "https://shop.example.com/api/auth/embed?authUi=header&parentOrigin=https://shop.example.com"

   HTTP 200 and { "url": "https://auth.kie.la/login-header?embed=1&…" } (exact path depends on authUi). Your server builds the iframe URL server-side with your app name and uuid — the browser never sees the uuid in JavaScript. 400 with parentOrigin required means the query string is missing or wrong; copy the full URL from the command above.

3. 3

   curl -s -o /dev/null -w '%{http_code}' https://shop.example.com/api/me

   Prints 401 on stdout before anyone has signed in — that is the expected result. It means “no session cookie yet”, not a misconfiguration. After a successful sign-in in the browser, the same command with the session cookie should print 200 and JSON { "profile": { … } } (use curl -s -b cookies.txt … if you saved cookies from the browser).

4. 4

   curl -s -X POST https://shop.example.com/api/session \
     -H 'Content-Type: application/json' \
     -d '{"exchange":"…","parentOrigin":"https://shop.example.com"}'

   With the placeholder exchange in the command above, the expected output is {"error":"Exchange invalide ou expiré"} (401) — you cannot forge this token. After a real sign-in in the iframe, kie-la-auth.js POSTs the one-time exchange your server receives from postMessage; then expect 200, { "ok": true, "profile": { … } }, and a Set-Cookie header for your session. Use this line only to debug session exchange once the iframe flow works.

In DevTools → Network, filter by your domain to see /api/me, /api/config, /api/auth/embed, and /api/session. The verify call appears under the auth server host (iframe). postMessage does not appear there — that is normal.