Host this static page from an HTTPS origin whose hostname contains the literal
mheducation.com substring, for example
https://mheducation.com.example-owned-domain.com/.
Safety: this page has no backend collector and does not transmit, persist, replay, or use received tokens. It only displays receipt metadata in this browser session.
This mode is enabled only when the URL fragment is #reveal-token.
The raw value is displayed only in this browser DOM and is not sent to a server,
console, webhook, localStorage, or sessionStorage.