@maiki Thanks a lot for taking the time to reply.
Using topicId as described in the guide doesn’t make it work or change any symptoms. The URL requested of course changes to https://forum.foo.com/embed/comments?topic_id=2279 instead, but it gives the exact same error message.
I also tried changing the discourseEmbedUrl to https://foo.com/blog/2019-11-22/foo-0.9.6-released but this too didn’t make anything work better unfortunately.
Even if the case is that this is intentional, it needs to be documented. For example, are requests from a localhost site blocked? Even though it’s explicitly listed in allowed hosts? Is Discourse looking at the referrer field in the HTTP request, or what exactly is it using to trigger this error? This really need to be cleared up, because at this point there’s nothing I have found that explains why it’s not working 