Skip to main content
Quote embeds let you install the Kordless quoting surface on your own website. The embed loads your published Live Book and lets customers submit requests without leaving your page.

​
What an embed is

An embed is a JavaScript widget that renders a quote form on your page. It uses the same Book, the same evaluator, and produces the same quotes as the hosted path and the API. The only difference is where the customer interacts with it.

​
Installation

Each embed installation has a unique ID and a secret. Installations are managed from the Developers page under Components.

​
Creating an installation

  1. Go to Developers in your workspace.
  2. Under Installed components, choose Create.
  3. Name the installation and specify the origin domain where it will be embedded.
  4. Copy the installation secret — it is shown once.

​
Embedding the widget

Add the embed script to your page and initialize it with your installation ID:
The widget loads your published Live Book, renders the quote spec’s services and inputs, and handles the evaluation and display of the quote result.

​
Origin scoping

The installation is scoped to the domain you registered. Requests from unregistered origins are rejected. This prevents your embed from being used on unauthorized sites.

​
Secret rotation

You can rotate the installation secret or revoke the installation entirely from the Developers page. Rotating the secret generates a new one — update your embed configuration to use it. Revoking an installation immediately stops the widget from loading.

​
What embeds share with other surfaces

  • The same published Live Book version.
  • The same evaluator and pricing logic.
  • The same quote receipt and derivation.
  • The same commitment mechanics (hold, deposit, handoff).

​
Test and Live

Embeds work in both environments:
  • Test — Point the embed at the Test environment to test without affecting Live customers.
  • Live — Point the embed at the Live environment for production use.
The environment is determined by the installation configuration, not by the page URL.

​
Security model

  • The embed secret is not a bearer API key. It cannot be used to call the /v1 API directly.
  • The embed loads read-only quote spec and produces quotes through a scoped surface — it cannot mint keys, manage webhooks, or access request logs.
  • Origin scoping prevents the embed from being used on domains you did not register.
  • Live embed secrets (sk_live_-equivalent) are never exposed in browser-accessible code beyond the scoped installation token.
Browser quote components get limited installations, never raw sk_ keys. An embed secret is scoped to the installation and cannot be used as an API key.