Embedded iframe parent page checklist

Embedded signing is not “drop any Inkpacket URL in an iframe.” The parent page has a short list of jobs: it must be an allowed origin, it must frame a tokenized signer, it must listen for the right postMessage shape, and it must not treat that message as the legal record. Miss one and the browser refuses the frame, the PIN leaks, or your UI advances on a forged event.

Which URL to pick is embed signing versus a signing link. The allowlist and snippet live in embedded signing on your own site and Docs. Features is embedded signing. This guide is the parent page after you have already decided to frame.

Before you add the iframe

1. Send the envelope first. The desk copies Embed URL next to the signing link — How to embed this envelope. POST /api/v1/packets/:id/send returns embedUrl.
2. Put the host origin in EMBED_ALLOWED_ORIGINS if it is not inkpacket.com. Signing surfaces send Content-Security-Policy frame-ancestors for 'self', https://inkpacket.com, https://www.inkpacket.com, and that list.
3. Do not frame /pricing, /desk, or /blog. Other routes send X-Frame-Options SAMEORIGIN and frame-ancestors 'self'.
4. Generate the token when the right person is already on your page. Do not publish a long-lived embed URL on a public marketing page.

Inkpacket omits X-Frame-Options on /sign and /embed so more than one host can frame them. Use /embed/sign/TOKEN for compact chrome, or the same /sign/TOKEN the invite email uses. Both are the same signer and the same envelope.

The snippet the parent needs

Desk help shows an iframe at 100% width and 720 height, border 0, with allow="clipboard-write". The script listens for message and returns early unless event.data.source is inkpacket. Types are viewed, signed, and completed. The payload is { source: "inkpacket", type, token }. Ignore everything else. A random tab can post to you.

On the parent page

• Keep your chrome. Inkpacket keeps the PDF, the fields, and the audit.
• Share an access code on a second channel if you set one. Do not print the PIN next to the iframe on a page that is reachable without a login.
• A later sequential signer framed too early sees This envelope is waiting for an earlier signer inside the frame. They cannot view the PDF yet.
• Void kills the embed URL. Correct that changes the email retires the old token — recopy Embed URL from the desk.
• Decline inside the iframe closes the whole envelope. One refusal stops every other link.

After five wrong PIN guesses the lockout is 15 minutes inside the frame too — access-code lockout recovery. Wait. Do not mint a second envelope because the iframe showed the lock screen.

The server record is not postMessage

Use viewed, signed, and completed to advance your own UI — hide a spinner, unlock the next onboarding step. Do not write an invoice or close a ticket from that event alone. A parent tab can lie. A verified webhook cannot. Listen for envelope status webhooks and when webhook delivery fails are the server path. The desk audit trail is the human record.

What the parent is not responsible for

• Not charging a card. Live checkout is not part of this path. Stripe off: Payments not live.
• Not sending the invite SMS. Text-message (SMS) is coming soon. The iframe still loads.
• Not Drive archive. The completed PDF stays on the envelope.
• Not a monthly cap waiver. One send is one envelope whether you frame it or mail it.

This path is live and does not wait on Drive or payment keys. Text-message (SMS) is coming soon. If Resend is missing, you still have embedUrl after send. Frame that. Do not POST send again with a new Idempotency-Key because the parent page 404’d — that is a second envelope. Copy the current Embed URL from the desk after a correct; an old iframe src is a retired token, not a broken host.

Caps and what is not open yet

Free allows 5 packets a month. Free at 5 packets a month is the live cap desk send, bulk rows, Web Form fills, and API send share. Hitting it returns HTTP 402 ENVELOPE_LIMIT. Starter is 20 envelopes — more than Free — plus 3 published Web Forms. Seat counts are planning numbers; invite does not refuse when a workspace is full.

Billing is published, not charging. Checkout is not open. Text-message (SMS) is coming soon. Drive missing: Drive not configured. Stripe off: Payments not live. The iframe does not wait on those keys. The FAQ and embedded signing on Features describe the same allowlist and events.

Allowlist the host. Frame the token. Listen for source inkpacket. Persist completed from a webhook. Stay on that envelope id. Then file the stamped PDF from the envelope — the parent page was only the door. Open a workspace on Free — see published pricing — send one envelope, copy Embed URL, and load the snippet on a localhost origin you have added to EMBED_ALLOWED_ORIGINS before you promise a production portal.