The authorization token in the URL returned has a lifetime of 5 minutes. You need to get a new URL for each embedding session.