1. White Label Auto-Login URL Token vs Metricool API Token

At Metricool, you will distinguish two types of tokens:

The first is added as an access key to the autoin link that you will use to create the iframe in your client's account. This token is individual and specific to each of the brands you create for your White Label integration. Here is an example of the general structure of an auto-login link for iframe creation:

https://app.metricool.com/autoin/[WL_TOKEN]?redirect=/planner

You can retrieve this "White Label Token" by going to the menu > Brand Settings > White Label and selecting one of the two available access URLs. The token will be unique and will change for each of the brands you have added. You can also automate the creation of the auto-login link with the access token by performing a Get type request to our API (you can find the documentation here). Here is an example:

https://app.metricool.com/api/admin/profile?blogId=&userId=&refreshBrandCache=false

The second token is the general access key to our API for your Metricool account, and not for the White Label integration. This Token will serve you to integrate Metricool with Looker Studio, Zapier, Make, or Canva, as well as with other tools that require a connection to our API, provided they are developed by you. You will find it by going to the menu > Account Settings > API.

If you use this last token as the access key in the auto-login link, the iframe will not be displayed in your product, and a syntax error will appear in your console.

2. Error: Referrer Policy; Content-Security-Policy: frame ancestor

A common error is related to Content Security Policies (CSP) under the "frame-ancestors" attribute. This error occurs when your web server attempts to load a page or iframe that is not allowed by your security policies. When checking the console, you will find an error of this type:

To remedy this, add the Referrer Policy attribute to your iframe, before the source (src). Here is an example:

<iframe referrerpolicy="origin" src="https://app.metricool.com/autoin/xxxxxxxxxxx"  …………></iframe>

3. Session Mixing

If you keep both the main Metricool account (the one from which you made the payment) and your product account where you insert your iframe open in the same browser, the information from both may get mixed up. Furthermore, you might encounter redirection errors. To avoid this, make sure you always open both accounts in different browsers, or open one of the two in a private (incognito) browsing window in your work browser.

Additional Resources

Updated on: 04/11/2025