Security headers and embed framing

Inkpacket’s response headers are split on purpose. Every path sends X-Content-Type-Options: nosniff, Referrer-Policy: strict-origin-when-cross-origin, and a Permissions-Policy that disables unused powerful APIs. Strict-Transport-Security is added only when VERCEL_ENV=production. There is no sitewide enforce Content-Security-Policy beyond frame-ancestors — that avoids breaking the Next.js desk and the optional tag manager. Signing surfaces are the exception for framing. That is embed-framing honesty: the product says which routes may sit in an iframe, and it does not pretend marketing or the desk can.

How to iframe the signer is embedded signing on your own site. When to use the token in a tab instead is embed signing versus a signing link. The parent-page checklist is embedded iframe parent page checklist. Desk help is Docs. Features is embedded signing. This guide is the header split.

After you send an envelope, the desk copies Embed URL next to the signing link. POST /api/v1/packets/:id/send returns embedUrl. Iframe /embed/sign/TOKEN for a compact chrome, or the same /sign/TOKEN link the invite uses. Access codes still apply inside the iframe. The iframe posts viewed, signed, and completed to the parent. This path is live and does not wait on Drive or payment keys. Text-message (SMS) is coming soon — live card checkout is not part of this path.

Who may frame what

• /sign and /embed omit X-Frame-Options so more than one host can frame them.
• Those surfaces send Content-Security-Policy: frame-ancestors for 'self', https://inkpacket.com, https://www.inkpacket.com, and EMBED_ALLOWED_ORIGINS.
• Other routes send X-Frame-Options: SAMEORIGIN and frame-ancestors 'self'.
• Do not frame /pricing, /desk, /blog, or /signup. /signup stays locked.

inkpacket.com is always allowed. Extra iframe hosts go in EMBED_ALLOWED_ORIGINS as a comma-separated list. If your parent origin is not on that list, the browser blocks the frame. That is not a void and not an expiry. Add the origin and reload. Do not copy the Embed URL into a host you have not allowlisted and then treat a blank iframe as a broken envelope.

What the parent hears

The iframe posts { source: "inkpacket", type, token } on viewed, signed, and completed. A sequential later signer who opens early still sees This envelope is waiting for an earlier signer inside the iframe. The parent hears nothing useful until it is their turn. Do not advance a portal because postMessage has been quiet. First-signer waiting message is that page.

Permissions-Policy leaves clipboard-write at the browser default so the desk can copy signing and embed URLs. Camera, microphone, geolocation, payment, and the rest of the unused powerful APIs are disabled. That policy is not a payment-not-live state. Payments not live is a Stripe flag on a different Settings card.

What is not a header

• HSTS is off unless VERCEL_ENV=production. A local preview will not send it.
• There is no sitewide enforce CSP for scripts. frame-ancestors is the CSP that ships.
• X-Frame-Options on /sign or /embed would fight the allowlist. Inkpacket omits it there.
• A missing EMBED_ALLOWED_ORIGINS value does not unlock every host. inkpacket.com is still the floor.

The FAQ states the same embed rules. Desk help has the snippet. Do not add X-Frame-Options: DENY on your parent and expect the child to relax it. The child is Inkpacket. The parent must allow the iframe; Inkpacket must allow the parent via frame-ancestors.

The click-path

1. Send an envelope. Copy Embed URL from How to embed this envelope.
2. Put that URL in an iframe on a host you already operate.
3. Confirm the host is inkpacket.com or listed in EMBED_ALLOWED_ORIGINS.
4. Listen for source inkpacket and type viewed, signed, or completed.
5. Do not iframe /desk or /pricing. Those routes send SAMEORIGIN.

Ask Inkpacket for how to embed signing or embed url to open help. Those phrases stay on the product screens. This article is the public version of why a marketing page will not load in your portal and why a signing token will.

Soft-fails are not framing

A blank iframe is usually an origin miss, a waiting page, an access-code gate, or an expired token. It is not a text. Text-message (SMS) is coming soon. Drive not configured and Payments not live live on other paths. Share an access code separately; it is not in the embed URL. After five incorrect tries the page locks for 15 minutes — that 429 is a PIN lockout, not a frame-ancestors failure.

Caps and what is not open yet

Copying an embed URL is not a send. The send that minted the token already counted. Free allows 5 packets a month. Free at 5 packets a month is the live cap desk send, bulk rows, Web Form fills, and API send share. Hitting it returns HTTP 402 ENVELOPE_LIMIT. Starter is 20 envelopes — more than Free — plus 3 published Web Forms. Seat counts are planning numbers; invite does not refuse when a workspace is full.

Billing is published, not charging. Checkout is not open. Text-message (SMS) is coming soon. Drive missing: Drive not configured. Stripe off: Payments not live. Those flags do not rewrite frame-ancestors. The FAQ and embed on Features use Embed URL and frame-ancestors in the same words.

Frame only /sign and /embed. Leave the desk locked. Listen for postMessage. Stay on that envelope id. Then file the stamped PDF after completed — the headers were the product telling the truth about what may be framed. Open a workspace on Free — see published pricing — or sign in and copy one Embed URL so the allowlist is something you have tested.