diff --git a/documentation/reference-library-index.md b/documentation/reference-library-index.md
index 7c33c5c3d..7c6bd82f7 100644
--- a/documentation/reference-library-index.md
+++ b/documentation/reference-library-index.md
@@ -280,6 +280,8 @@ and a change here can break other maps.
   `import … from '@map/utils/peopleGroupName.js'`
 - **peopleGroupPoints** — peopleGroupPoints.js — SHARED (@map/utils/peopleGroupPoints.js).  
   `import … from '@map/utils/peopleGroupPoints.js'`
+- **publicEmbed** — publicEmbed.js: the Share menu's Embed codes for THIS plugin, from the tree's PUBLIC address.  
+  `import … from '@map/utils/publicEmbed.js'`
 - **scrollport** — findScrollportAncestor — the nearest ancestor that actually scrolls.  
   `import … from '@map/utils/scrollport.js'`
 - **viewportScrim** — viewportScrim.js — make a position:fixed full-screen SCRIM actually cover the VIEWPORT,  
diff --git a/library/utils/embedBase.js b/library/utils/embedBase.js
index d0231a7e2..f8842425a 100644
--- a/library/utils/embedBase.js
+++ b/library/utils/embedBase.js
@@ -221,12 +221,11 @@ export function absoluteEmbedUrl(leaf, profileConfig = null) {
  * @returns {string}
  */
 export function resolvePublicBase(profileConfig) {
+  // https only (an http base would give mixed-content codes on an https partner page), plus a local test server
+  const ok = (v) => typeof v === 'string' && /^(https:\/\/|http:\/\/(127\.0\.0\.1|localhost)(:\d+)?\/)/i.test(v.trim())
   const fromConfig = profileConfig?.shareBaseUrl
-  if (typeof fromConfig === 'string' && /^https?:\/\//i.test(fromConfig.trim())) return stripSlashes(fromConfig)
-  if (typeof window !== 'undefined') {
-    const fromHost = window.MAP_SHARE_BASE_URL
-    if (typeof fromHost === 'string' && /^https?:\/\//i.test(fromHost.trim())) return stripSlashes(fromHost)
-  }
+  if (ok(fromConfig)) return stripSlashes(fromConfig)
+  if (typeof window !== 'undefined' && ok(window.MAP_SHARE_BASE_URL)) return stripSlashes(window.MAP_SHARE_BASE_URL)
   // typeof-guarded: a build or a test that defines no __DOXA_SHARE_BASE__ reads '' instead of throwing
   return stripSlashes(typeof __DOXA_SHARE_BASE__ === 'string' ? __DOXA_SHARE_BASE__ : '')
 }
diff --git a/library/utils/publicEmbed.js b/library/utils/publicEmbed.js
index 6f2912949..b6a82afda 100644
--- a/library/utils/publicEmbed.js
+++ b/library/utils/publicEmbed.js
@@ -35,7 +35,9 @@ export const publicLeafUrl = (base, embedPath) => {
 
 function loadManifest(base) {
   if (!cache.has(base)) {
-    const p = fetch(base + '/manifest.json', { credentials: 'omit' })
+    // the default credentials ('same-origin'): nothing is sent to a cross-origin public host, and behind a login gate
+    // a same-origin base keeps its session
+    const p = fetch(base + '/manifest.json')
       .then((r) => (r.ok ? r.json() : null))
       .catch(() => { cache.delete(base); return undefined })   // a network failure may be retried later
     cache.set(base, p)