All features
White Label

Your portal. Inside your product.

Embed the full Apitide platform inside your SaaS product with your own branding. Issue JWTs from your backend, gate capabilities per customer, restrict embedding to your domains, and override styles with raw CSS — zero Apitide branding visible to your customers.

100%

Apitide branding removed

JWT

token from your own backend

allowlist

domain-restricted embedding

Full Custom Branding

Your logo, colours, fonts, and shape — zero Apitide branding visible

The embedded portal inherits a complete design token system: primary and secondary colours, background and surface colours, text colours, border colours, button text colour, font family, and border radius. Every visual element in the embedded portal reads from these tokens — buttons, sidebar navigation, cards, status badges, input fields, and modals.

Configure tokens once per organisation in the White Label settings panel. The portal preview updates in real time so you can see exactly how your brand configuration renders before issuing any tokens to customers. The preview is a live iframe — not a mockup — so what you see is what your customers will see.

The sidebar shows your company name and initials, not the Apitide wordmark. Page titles reflect your company name. There is no "Powered by Apitide" attribution in the embedded view — the portal appears as a native part of your product to end users.

100%

Apitide branding removed

Capability Gating

Each customer sees only the sections they need — nothing more

Not every customer needs access to every part of the platform. A customer who uses only your workflow automation features does not need to see the MCP server management panel or the analytics dashboard. Capability gating lets you configure exactly which sections are visible in each customer's embedded portal.

Available capabilities include Workflows, Connections, MCP Servers, Access Control, Analytics, Executions, and Published. Select any combination when generating an embed token — the embedded portal's sidebar renders only the selected sections, and direct navigation to hidden sections is blocked.

Capability selection is per token, not per customer. This means you can issue different tokens to different user roles within the same customer organisation — a developer might see Workflows and Connections, while an operations user sees only Analytics and Executions. The capability set is encoded in the signed JWT and cannot be modified by the client.

per-token

capability gating at the token level

JWT-Based Authentication

Issue tokens from your backend — Apitide never sees your customers' credentials

The embedded portal is authenticated via a signed JWT issued by your backend. You call the Apitide embed token endpoint from your server — passing the customer's store name, role, and optional user identity fields — and receive a short-lived signed token. Embed that token in the iframe URL or pass it as a query parameter and Apitide validates it, creates a scoped session, and renders the portal for that customer.

The token is signed with a secret you control. Apitide validates the signature but never needs to know anything about the customer beyond what is in the token. Your authentication system remains authoritative — customers log in to your product via whatever method you use, and your backend decides when to issue an embed token.

Store provisioning is automatic. If the store name in the token does not exist in your organisation yet, Apitide creates it on first use. Subsequent tokens for the same store name resolve to the same store — no pre-provisioning step, no manual store setup per customer. This makes embedding suitable for multi-tenant SaaS products where customer environments are created on demand.

signed JWT

your backend stays authoritative

Allowed Domain Restrictions

The portal only loads inside your domains — prevents unauthorised embedding

Embed tokens are powerful credentials — they grant access to a customer's store with the capabilities and role encoded in the token. Allowing any website to embed the portal would let an attacker who obtains a token embed it in their own page and operate on behalf of the customer.

Apitide enforces an allowlist of domains that are permitted to embed the portal. Configure your domains in the White Label settings — the embedded portal checks the parent frame's origin against this list on load. If the origin does not match, the portal refuses to render and displays an access denied message instead.

The domain check is performed client-side using the browser's ancestorOrigins API (with a document.referrer fallback for browsers that don't expose ancestor origins). This is the same mechanism browsers use for Content Security Policy frame-ancestors enforcement. You can configure as many allowed domains as you need — typically your production domain, a staging domain, and a local development origin.

allowlist

domains that can embed the portal

Custom CSS Override

Pixel-perfect control for integrations that need to go beyond design tokens

Design tokens cover the common customisation surface — colours, fonts, shape, spacing. But some integrations need more: remove a specific UI element, override a component's layout to fit a constrained sidebar, match a design system that uses custom focus ring styles or unusual button shapes.

The White Label configuration includes a raw CSS field that is injected into the embedded portal's scope on load. CSS custom properties from your token configuration are available as var(--embed-primary), var(--embed-secondary), and so on, so your override rules can reference the configured brand values rather than hardcoding hex codes.

The injected CSS is scoped to the embedded portal root element — it does not leak into the parent page. This means you can use aggressive selectors (including element selectors like button and input) inside the override block without worrying about affecting your product's own styles. The parent page and the embedded portal have completely isolated CSS scopes.

scoped

custom CSS — no parent page leakage

API OrchestrationParallel execution and transformationsSecurity & ComplianceCredentials, masking, and audit logsMCP ServerConnect any AI agent to your APIs

Ship your white-label portal this week

Configure branding, generate an embed token from your backend, and drop one iframe tag into your product. Your customers see your brand — not ours.