So it turns out that I needed to enable the domain for embeds not only at the tenant level, but at the site level. To do this I had to not only be site owner, but Site Collection Administrator, so now it's all working. Thanks Ron and Fay for getting me there