BlogTag
Embedded signing
Iframe the same tokenized signer on a host page you already operate, with postMessage hooks for viewed, signed, and completed.
Related product pages
Guides
Embedded signing on your own site
Iframe an Inkpacket signing token on a host page you already operate: /embed/sign/TOKEN, frame-ancestors, EMBED_ALLOWED_ORIGINS, and postMessage events for viewed, signed, and completed.
Embed signing versus a signing link
Choose an Inkpacket iframe or an invite URL: same token, same audit, different chrome. Embed when you already operate the host page; send a link when the inbox is the door.
Embedded iframe parent page checklist
A parent-page checklist for Inkpacket embedded signing: allowlist the host, iframe /embed/sign/TOKEN, listen for inkpacket postMessage, keep the PIN off the page, and treat webhooks as the server record.
Security headers and embed framing
Inkpacket sends nosniff, Referrer-Policy, and Permissions-Policy on every path. HSTS only when VERCEL_ENV=production. /sign and /embed omit X-Frame-Options and send frame-ancestors. Other routes stay SAMEORIGIN. That is embed-framing honesty.
Embed iframe versus popup framing
Iframe Inkpacket at /embed/sign/TOKEN for compact chrome, or open /sign/TOKEN in a popup. Same token. Same access code. That is iframe-versus-popup honesty — two frames, not two envelopes.