Embeddable on some sites only

Framing rules

• X-Frame-Options: SAMEORIGINdeny

  SAMEORIGIN allows a frame only on pages of the same origin.

• frame-ancestorsabsent

  No enforced Content-Security-Policy sets frame-ancestors.

• Set-Cookie × 7warning

  2 of 7 cookies do not go into a cross-site frame (AWSALBTG, login-status-p): a cookie needs SameSite=None; Secure for that. A login or session inside the frame can fail.

• Cross-Origin-Resource-Policyabsent

  Not sent. A cross-origin page with Cross-Origin-Embedder-Policy: require-corp cannot embed it.

HTTP 200 OK
airtable-datacenter-regions: us-east-1
cache-control: no-store, no-cache, must-revalidate
cf-cache-status: DYNAMIC
cf-ray: a579ac287c55ddf0-CMH
connection: close
content-security-policy: style-src 'unsafe-inline' https:; block-all-mixed-content; object-src 'none'; base-uri 'none'; report-uri https://airtable.com/.csp/report; script-src 'nonce-6jIdZOiRMdOE' 'unsafe-inline' 'strict-dynamic' 'report-sample' https:; worker-src 'self' blob:
content-type: text/html; charset=utf-8
date: Mon, 09 Nov 2026 03:18:51 GMT
document-policy: js-profiling, include-js-call-stacks-in-crash-reports
etag: W/"20f6b-47l029v/lJg5TDjUkhexwRgZZrA"
expires: Mon Nov 09 2026 03:18:51 GMT+0000 (Coordinated Universal Time)
referrer-policy: same-origin
reporting-endpoints: default="https://airtable.com/browserReports"
server: cloudflare
strict-transport-security: max-age=31536000; includeSubDomains; preload
transfer-encoding: chunked
vary: Accept-Encoding
via: 1.1 e3b7adb90a75b52117d9b6715b5221bc.cloudfront.net (CloudFront)
x-amz-cf-id: T5LB0NiVy_K7sVk4uS2E0ebUyTPig11-kPM5ZOAC697A5769CY9_EQ==
x-amz-cf-pop: CMH68-P3
x-cache: Miss from cloudfront
x-content-type-options: nosniff
x-frame-options: SAMEORIGIN
x-xss-protection: 1; mode=block
set-cookie: AWSALBTG=…; Expires=Mon, 16 Nov 2026 03:18:50 GMT; Path=/
set-cookie: AWSALBTGCORS=…; Expires=Mon, 16 Nov 2026 03:18:50 GMT; Path=/; SameSite=None; Secure
set-cookie: brw=…; path=/; expires=Tue, 09 Nov 2027 03:18:51 GMT; domain=.airtable.com; samesite=none; secure
set-cookie: brwConsent=…; path=/; expires=Mon, 09 Nov 2026 03:23:51 GMT; domain=.airtable.com; samesite=none; secure
set-cookie: login-status-p=…; path=/; expires=Thu, 01 Jan 1970 00:00:00 GMT; domain=.airtable.com; secure
set-cookie: __Host-airtable-session=…; path=/; expires=Wed, 10 Nov 2027 03:18:51 GMT; samesite=none; secure; httponly
set-cookie: __Host-airtable-session.sig=…; path=/; expires=Wed, 10 Nov 2027 03:18:51 GMT; samesite=none; secure; httponly

Fetched from our server with a plain browser request. Headers can differ by region, or when you are signed in.