I wrote a way of doing private team embeds https://observablehq.com/@endpointservices/embed Also I am fairly sure I could do the login-with-saleforce without Heroku using a variations of https://observablehq.com/@tomlarkworthy/oauth-examples Let me know if you want me to explore that further

also you can bypass CORS with https://observablehq.com/@tomlarkworthy/fetchp