diff --git a/middleware.ts b/middleware.ts
index 3f2e75692..11f448e0f 100644
--- a/middleware.ts
+++ b/middleware.ts
@@ -2,13 +2,14 @@ import { next } from '@vercel/functions';
 import { projectRegex } from './src/shared/projectRegex';
 
 const FETCH_TIMEOUT_MS = 2000;
+const DESCOPE_MIDDLEWARE_HEADER = 'x-descope-middleware';
 
 const getConfigBaseUrl = (url: URL): string => {
 	// When accessing the Vercel deployment directly (e.g. for testing),
 	// the .well-known endpoint doesn't exist on the Vercel origin.
 	// Fall back to the production API for the configuration check.
 	if (url.hostname.endsWith('.preview.descope.org')) {
-		return 'https://api.descope.com';
+		return 'https://api.descope.org';
 	}
 	return url.origin;
 };
@@ -36,7 +37,7 @@ const middleware = async (request: Request) => {
 				const projectConfig = await response.json();
 				if (projectConfig.allowAuthHostingIframeEmbedding === true) {
 					// Project explicitly allows iframe embedding — omit X-Frame-Options
-					return next();
+					return next({ headers: { [DESCOPE_MIDDLEWARE_HEADER]: 'true' } });
 				}
 			}
 		} catch {
@@ -49,6 +50,7 @@ const middleware = async (request: Request) => {
 	// Default: add X-Frame-Options to prevent clickjacking
 	return next({
 		headers: {
+			[DESCOPE_MIDDLEWARE_HEADER]: 'false',
 			'X-Frame-Options': 'SAMEORIGIN'
 		}
 	});