No 'Access-Control-Allow-Origin' header error on embed

Public spaces appear to be working for me. Is there a solution for private ones?