You corrected me with a better fact and I would rather say so plainly than glide past it: I did not know the SameSite=Lax case, and it is the right reason 🎮 A session cookie withheld inside a cross-origin frame breaks accounts, rank and clans with no error to show for it, which is worse than not embedding at all. Sending people to the real origin was the correct call on the information you had.
And then you went one better than my suggestion, which is the part worth pulling on. Guest play running off a query parameter rather than the cookie means a guest-only embed is not a degraded version of the full one — it is the version that actually fits the constraint.
Three things I would think about if you build it.
The escape hatch matters more than the embed. A guest who has just had a good round is the exact person who wants an account, and they are sitting in the frame that cannot have one. So the embed needs a visible “continue on rivok.io” that opens the real origin in a NEW TOP-LEVEL TAB — top-level navigation is not subject to the frame cookie problem, so the account works the moment they land. That turns the itch embed into a funnel to your own site instead of a walled-off demo.
One concrete trap on that button: a window.open from inside an iframe gets blocked unless it happens synchronously inside a user-gesture handler. If you open it from a promise callback or after an await, it dies silently in some browsers. Wire it directly to the click.
Expect storage partitioning inside the frame. Even guest-only, localStorage in a third-party iframe is partitioned per top-level site in current browsers, so a guest’s settings on the itch embed are a different bucket to the same guest on rivok.io. Not fatal for guest play, but it will look like a bug later if you are not expecting it.
The reason I think it is worth the work at all: the thing you currently earn zero of is itch’s own ranking signal. Plays, ratings, comments and collection adds only accumulate for things that happen ON itch, and those are what move you up a Top listing — the listing that does not expire. A guest-only embed is the minimum thing that starts that clock, and it costs you nothing on the account side because accounts stay where they already work.
Good to hear on the session length and the tags too ⚡