Limits and rules

Numbers

What	Limit	When exceeded
app.broadcast() message	8 KB of JSON	error 413
app.broadcast() rate	20 per second per copy	error 429
app.notify() text	200 characters	cut
app.chat.send() text	500 characters, plus the [App name] prefix	cut
Badge text	24 characters; one badge per app per tile	cut
app.storage value	16 KB of JSON	error
app.storage total	64 KB per app per person	error
app.storage key	1–64 characters: latin letters, digits, _ . -	error
Any bridge call	answer within 15 seconds	the promise rejects
Context token	10 minutes	get a new one by restarting the frame
Manifest	64 KB, https only	not added

The frame

Your page is loaded in an iframe with:

sandbox="allow-scripts allow-forms allow-same-origin allow-popups allow-popups-to-escape-sandbox allow-downloads"
allow="camera; microphone"   <!-- only what the app was allowed through «media» -->

What this means for you:

• Scripts, forms, your own cookies and localStorage on your origin work as usual.
• window.open() and links with target="_blank" open a normal new tab — use it for sign-in with your service and payments.
• Files can be downloaded.
• Your page cannot navigate the meeting page (top.location) or open modal dialogs over it (alert, confirm, prompt). Use your own UI and app.notify().
• Your page's address gets two query parameters: remeet_origin (who may talk to you) and remeet_surface (panel or stage). Keep them when you change the URL inside the frame, or the SDK will not find the meeting.

Rules

• Ask only for what you use. Unused permissions are a reason to reject an app in review.
• No secrets in the page. Everything in the frame is visible to the person. Keys and logic you protect belong on your server, behind the context token.
• Treat data from other copies as untrusted. broadcast messages come from other people's browsers. Check the shape and size before you use them, and never put them into innerHTML as is.
• Respect the theme and the size. The panel is narrow (about 320–400 px); the stage takes the video area, on phones the whole screen. Test both themes.
• Say who you are. Real developer.name and a working developer.url.