# Deploy it Your Spaces app is a **static page** — host it anywhere, on your own branded origin. The verified Space runs on the Witbitz origin inside the embedded iframe, so the room key and plaintext stay off your page. > **Get Started path:** [Vault Spaces](./vault-spaces.md) → this → [**Verify it**](./verify.md). --- ## Host the page Host your HTML on **Cloudflare Pages, Netlify, S3, or your own server** — no build step, no backend. Two CSP notes for your page: - allow **`script-src`** for the origin you load from (`https://witbitz.chat` for `embed.js`, or the SDK origin); - for the **headless SDK**, allow **`connect-src`** for your Space `endpoint` (default `https://api.witbitz.chat/v1/space`). That's it — the Space itself is served, verified, from the Witbitz origin inside the iframe. ## If you host the Spaces app itself If you host the *Spaces app* (rather than embedding the hosted one), embedding is **off by default** (`frame-ancestors 'self'`); set `SPACE_EMBED_ORIGINS` to the origins allowed to frame it ([embed](./embed.md)). ## Production notes for your tenant You registered a tenant in [Vault Spaces](./vault-spaces.md) — that meters usage to you and is your identity on the `/v1` platform. When you go past the walkthrough: - **Keep a demo tenant.** A demo tenant is real and works immediately, but auto-purges at its `expires_at`. To make it permanent — **same id and keys**, no more expiry — upgrade it with an author coupon: ```bash curl -sX POST https://api.witbitz.chat/v1/tenant/upgrade \ -H "Authorization: Bearer wsk_…" -H "X-Author-Coupon: " ``` Or sign up non-expiring from the start — `POST /v1/tenants/signup` (`X-Author-Coupon`). No coupon? Email **hello@witbitz.chat**. - **Owner-governed rooms** — mandate admission tiers that are provably yours across every room your app creates: built, built and tested, not yet enabled in production ([owner rule](./identity-and-admission.md#the-owner-rule)). - **A bespoke Witbitz-hosted app** — instead of hosting your own page, Witbitz provisions your tenant its **own deployment**: its own origin (`witbitz-spaces-.pages.dev`), its own key vault (a separate sign-in origin that confines the room keys — the same architecture the first-party Spaces runs on), its own split-key ecosystem key, and your agent config baked in. Sign-in needs **zero setup on your side** — Google and email-code run through the central Witbitz auth service, minted as your origin. Your app version is **yours**: it doesn't silently change when the reference Spaces updates. Rooms are stamped to your tenant and split-key by default. Provisioned per tenant — email **hello@witbitz.chat** with your tenant id and app name. - The billed `/v1` surface is invite-gated private beta; the **demo tenant** and the keyless `/space` runtime work openly ([Platform API](./api-reference.md)). ## Next - [**Verify it**](./verify.md) — confirm the deployed Space is exactly what it claims. - **Reference:** [Platform API (OpenAPI)](./api-reference.md) · [The SDK](./sdk.md).