Embed iframe versus popup framing

After you send an envelope, the desk copies Embed URL next to the signing link. Iframe /embed/sign/TOKEN for a compact chrome, or open the same /sign/TOKEN link the invite email uses in a popup. POST /api/v1/packets/:id/send returns embedUrl. Access codes still apply inside either frame. That is iframe-versus-popup honesty: two host shapes, one token, and a popup is not a second envelope you can file twice.

Whether to leave the desk at all is embed signing versus a signing link. The parent checklist is embedded iframe parent page checklist. Headers are security headers and embed framing. Desk help is Docs. This guide is iframe versus popup on that token.

The FAQ says you can iframe the signer on a page you already operate. Features lists the same path under embedded signing. Ask Inkpacket for embed iframe versus popup framing to open this article. Ask how to embed signing to open help. Ask copy embed url to open Documents → new #embed. Those phrases stay on the product screens. This article is the public version of which window you open.

Pick the frame

• Iframe /embed/sign/TOKEN when the signer should stay on your host page. Compact chrome. postMessage viewed, signed, and completed to the parent.
• Popup or tab /sign/TOKEN when you want the full signing page the email already uses. Same token. Same PIN. Same waiting page on a later sequential signer.
• Do not mint a second envelope to “get a popup URL.” The signing link is already the popup URL.
• Do not skip EMBED_ALLOWED_ORIGINS on an iframe host you do not control from inkpacket.com.

Signing surfaces send Content-Security-Policy frame-ancestors for inkpacket.com plus EMBED_ALLOWED_ORIGINS. Inkpacket omits X-Frame-Options on /sign and /embed so more than one host can frame them. Other routes are not meant to be framed. A popup does not need your origin on that allowlist. An iframe does, if the host is not already listed. This path is live and does not wait on Drive or payment keys. Text-message (SMS) is coming soon.

What neither frame is

• Not a verified webhook. The parent tab can forge postMessage. Wait for HMAC-SHA256 of timestamp.body — webhook signature verify checklist.
• Not live card checkout. Stripe off: Payments not live. Signing still completes.
• Not a Web Form slug. /form/SLUG is intake. The signer still opens a token later.
• Not a Team inviteUrl. A teammate cannot finish an envelope in that iframe.

A later sequential signer framed too early sees This envelope is waiting for an earlier signer inside either window. People who share the current order can both be live — when recipients share a sequential order. Void stops every signing and embed link. The popup dies the same way the iframe does. Correct retires the previous token if the email changes — both frames then need the new URL from the desk. Resend emails the existing link; it does not mint a second embedUrl.

The host page you already operate is the product. Inkpacket does not ship a popup SDK or a named window target. window.open on /sign/TOKEN is enough. If the popup is blocked, fall back to the same URL in the current tab. That is still one envelope.

The click-path

1. Send the envelope. Copy Embed URL and the signing link from that document.
2. For an in-page signer, iframe /embed/sign/TOKEN. Add your host to EMBED_ALLOWED_ORIGINS if the frame stays blank.
3. For a button that opens a window, use /sign/TOKEN. Do not wrap that URL in a second envelope.
4. Listen for postMessage if you iframe. Persist status from a verified webhook or GET the envelope with a Bearer token.
5. Share an access code separately. It is not in the invite email and not in the iframe src.

Ask Inkpacket for how to embed signing to open help. Ask copy embed url to open the draft. Marketing Ask stays site Q&A and deep links. It will not write your host snippet from this article. Desk help has the iframe HTML. On a phone, Documents is a drawer row — the copy boxes are still on the envelope after send.

Caps and what is not open yet

Opening a frame is not a send. The send that minted the token already counted. Free allows 5 packets a month. Free at 5 packets a month is the live cap desk send, bulk rows, Web Form fills, and API send share. Hitting it returns HTTP 402 ENVELOPE_LIMIT. Starter is 20 envelopes — more than Free — plus 3 published Web Forms. Seat counts are planning numbers; invite does not refuse when a workspace is full.

Billing is published, not charging. Checkout is not open. Text-message (SMS) is coming soon. Drive missing: Drive not configured. Stripe off: Payments not live. Those flags do not mint a second token or turn a popup into a new envelope. The FAQ and More on embedded signing use /embed/sign/TOKEN and /sign/TOKEN in the same words.

Pick the iframe or the popup. Keep one token. File the stamped PDF when completed arrives. Open a workspace on Free — see published pricing — and host one throwaway both ways so iframe-versus-popup honesty is a pair of windows you have already watched, not two envelopes in the document list.