Document settings.iframe.allowed-parent-origins in site settings and em…

fern/products/docs/pages/customization/embedded-mode.mdx

@@ -29,6 +29,22 @@ Add the `embedded=true` query parameter to the URL:
 
 Embedded mode persists across navigation within a session, so internal links keep it active without the query string on every URL.
 
+## Allow third-party origins to frame your docs
+
+By default, Fern sets a `Content-Security-Policy: frame-ancestors 'self' https://*.buildwithfern.com` header on every page, which prevents third-party sites from embedding your docs in an iframe. The `?embedded=true` mode omits `frame-ancestors` entirely, allowing any origin to frame the page.
+
+To allow specific third-party origins to frame your docs without using `?embedded=true`, add them to `settings.iframe.allowed-parent-origins` in `docs.yml`:
+
+```yaml docs.yml
+settings:
+  iframe:
+    allowed-parent-origins:
+      - https://app.trumpet.app
+      - https://*.example.com
+```
+
+Each entry must be a valid CSP host source (`scheme://host[:port]`). Wildcards on the host label (`https://*.example.com`) are supported; bare `*`, keyword sources, and scheme-only values are rejected. The configured origins are appended to the default `frame-ancestors`, so `'self'` and `https://*.buildwithfern.com` remain in place.
+
 ## Embed external pages
 
 [Embedding external pages in your docs](/learn/docs/writing-content/markdown-media#embed-external-sites) uses the same `<iframe>` syntax, without `?embedded=true`.

fern/products/docs/pages/navigation/site-level-settings.mdx

@@ -752,6 +752,9 @@ settings:
   use-javascript-as-typescript: false
   folder-title-source: frontmatter
   substitute-env-vars: true
+  iframe:
+    allowed-parent-origins:
+      - https://app.example.com
 ```
 
 <ParamField path="settings.search-text" type="string" required={false} default="Search" toc={true}>
@@ -845,6 +848,29 @@ settings:
   </Note>
 </ParamField>
 
+<ParamField path="settings.iframe" type="object" required={false} toc={true}>
+  Configure which third-party origins are allowed to embed your docs in an iframe. By default, Fern sets a `Content-Security-Policy: frame-ancestors 'self' https://*.buildwithfern.com` header on every page. Use `?embedded=true` to omit `frame-ancestors` entirely and allow any origin to frame the page.
+
+  <Indent>
+  <ParamField path="settings.iframe.allowed-parent-origins" type="list of strings" required={false} toc={true}>
+    A list of origins to append to the `Content-Security-Policy: frame-ancestors` directive, allowing those origins to embed your docs in an iframe. Each entry must be a valid CSP host source of the form `scheme://host[:port]` (e.g. `https://app.example.com`, `https://*.example.com`). Bare wildcards (`*`), keyword sources (`'none'`, `'self'`), scheme-only sources (`https:`), and entries with paths are rejected.
+
+    ```yaml docs.yml
+    settings:
+      iframe:
+        allowed-parent-origins:
+          - https://app.trumpet.app
+          - https://*.example.com
+    ```
+
+    This produces a `Content-Security-Policy` header with:
+    ```
+    frame-ancestors 'self' https://*.buildwithfern.com https://app.trumpet.app https://*.example.com
+    ```
+  </ParamField>
+  </Indent>
+</ParamField>
+
 ## Page actions configuration
 
 Configure the page action buttons that appear throughout your documentation. `page-actions.options` holds two kinds of actions: built-in actions you toggle on or off with a boolean, and configurable actions — the [Install skills action](#install-skills-action) and [custom page actions](#custom-page-actions) — that you define with their own settings. Set `page-actions.default` to choose which action shows first.