From bfd1efc46bb20429d75920d0ef0a5de9a0ba3baf Mon Sep 17 00:00:00 2001
From: "fern-api[bot]" <115122769+fern-api[bot]@users.noreply.github.com>
Date: Fri, 18 Sep 2026 22:47:14 +0000
Subject: [PATCH] =?UTF-8?q?Document=20settings.iframe.allowed-parent-origi?=
 =?UTF-8?q?ns=20in=20site=20settings=20and=20em=E2=80=A6?=
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

---
 .../pages/customization/embedded-mode.mdx     | 16 ++++++++++++
 .../pages/navigation/site-level-settings.mdx  | 26 +++++++++++++++++++
 2 files changed, 42 insertions(+)

diff --git a/fern/products/docs/pages/customization/embedded-mode.mdx b/fern/products/docs/pages/customization/embedded-mode.mdx
index 6828d1d76c..193b06f783 100644
--- a/fern/products/docs/pages/customization/embedded-mode.mdx
+++ b/fern/products/docs/pages/customization/embedded-mode.mdx
@@ -29,6 +29,22 @@ Add the `embedded=true` query parameter to the URL:
 
 Embedded mode persists across navigation within a session, so internal links keep it active without the query string on every URL.
 
+## Allow third-party origins to frame your docs
+
+By default, Fern sets a `Content-Security-Policy: frame-ancestors 'self' https://*.buildwithfern.com` header on every page, which prevents third-party sites from embedding your docs in an iframe. The `?embedded=true` mode omits `frame-ancestors` entirely, allowing any origin to frame the page.
+
+To allow specific third-party origins to frame your docs without using `?embedded=true`, add them to `settings.iframe.allowed-parent-origins` in `docs.yml`:
+
+```yaml docs.yml
+settings:
+  iframe:
+    allowed-parent-origins:
+      - https://app.trumpet.app
+      - https://*.example.com
+```
+
+Each entry must be a valid CSP host source (`scheme://host[:port]`). Wildcards on the host label (`https://*.example.com`) are supported; bare `*`, keyword sources, and scheme-only values are rejected. The configured origins are appended to the default `frame-ancestors`, so `'self'` and `https://*.buildwithfern.com` remain in place.
+
 ## Embed external pages
 
 [Embedding external pages in your docs](/learn/docs/writing-content/markdown-media#embed-external-sites) uses the same `<iframe>` syntax, without `?embedded=true`.
diff --git a/fern/products/docs/pages/navigation/site-level-settings.mdx b/fern/products/docs/pages/navigation/site-level-settings.mdx
index b2cb6c60f3..282a19f78f 100644
--- a/fern/products/docs/pages/navigation/site-level-settings.mdx
+++ b/fern/products/docs/pages/navigation/site-level-settings.mdx
@@ -752,6 +752,9 @@ settings:
   use-javascript-as-typescript: false
   folder-title-source: frontmatter
   substitute-env-vars: true
+  iframe:
+    allowed-parent-origins:
+      - https://app.example.com
 ```
 
 <ParamField path="settings.search-text" type="string" required={false} default="Search" toc={true}>
@@ -845,6 +848,29 @@ settings:
   </Note>
 </ParamField>
 
+<ParamField path="settings.iframe" type="object" required={false} toc={true}>
+  Configure which third-party origins are allowed to embed your docs in an iframe. By default, Fern sets a `Content-Security-Policy: frame-ancestors 'self' https://*.buildwithfern.com` header on every page. Use `?embedded=true` to omit `frame-ancestors` entirely and allow any origin to frame the page.
+
+  <Indent>
+  <ParamField path="settings.iframe.allowed-parent-origins" type="list of strings" required={false} toc={true}>
+    A list of origins to append to the `Content-Security-Policy: frame-ancestors` directive, allowing those origins to embed your docs in an iframe. Each entry must be a valid CSP host source of the form `scheme://host[:port]` (e.g. `https://app.example.com`, `https://*.example.com`). Bare wildcards (`*`), keyword sources (`'none'`, `'self'`), scheme-only sources (`https:`), and entries with paths are rejected.
+
+    ```yaml docs.yml
+    settings:
+      iframe:
+        allowed-parent-origins:
+          - https://app.trumpet.app
+          - https://*.example.com
+    ```
+
+    This produces a `Content-Security-Policy` header with:
+    ```
+    frame-ancestors 'self' https://*.buildwithfern.com https://app.trumpet.app https://*.example.com
+    ```
+  </ParamField>
+  </Indent>
+</ParamField>
+
 ## Page actions configuration
 
 Configure the page action buttons that appear throughout your documentation. `page-actions.options` holds two kinds of actions: built-in actions you toggle on or off with a boolean, and configurable actions — the [Install skills action](#install-skills-action) and [custom page actions](#custom-page-actions) — that you define with their own settings. Set `page-actions.default` to choose which action shows first.