We allow developers to test Network Enabled Zero Permission within Embedded Player for Instant Games. You can also use our sample project here for reference.
You can setup Network Enabled Zero Permissions (NEZP) for a newly created app or for your existing app by following the steps here.
If you have a regular Instant games app that has public users, you can still safely mark the app as Network Enabled Zero Permissions and test specific bundles in the Zero Permissions Environment. Follow the Testing section in the Existing Apps Migration page.
If your app is not launched and you've marked it as Zero Permissions, the app will be loaded in the Zero Permissions environment for all of your users.
We've built a tool that can aid you in debugging overlay views. You can follow the guide here
--cors flag when starting the local server> $ http-server --cors --ssl -c-1 -p 8080 -a 127.0.0.1
<script src="https://connect.facebook.net/en_US/fbinstant.8.0.js"></script>
Note: You must try to access https://localhost:8080 at least once, as you might need to approve a security warning from your browser before continuing. If that is the case and you skip this step, your game may not load.
Due to some changes in CORS policies, you may need to access chrome://flags/#local-network-access-check and disable 'Local Network Access Checks' to enable the embedded player on Chrome.