Developers
Seal with the API, show the live card
Create the seal with the Developer API, then place a live card on a website Opcilo has approved. The card links to the full record. It does not replace that page.
Pair the API with the card
POST /api/v1/documents/{id}/seal fingerprints the file and returns a verification code. Put that code in the embed snippet on your page. Keep API keys in the Developer console. Do not place a key in the HTML.
The card on the approved site is loaded live. Verify on opcilo.com opens the full record at /verify/{code}. On that page, the address bar is the proof.
Copy the snippet
data-layout is compact (the default) or banner. data-theme is light, dark, or auto. Replace YOUR-CODE with the verification code from the seal response.
The script creates the iframe and sets referrerpolicy="origin" so Opcilo can check the parent site. A plain iframe still works at https://opcilo.com/embed/verify/{code}?layout=compact&theme=auto. Set referrerpolicy="origin" on that iframe too.
Live card snippet
<div data-opcilo-card data-code="YOUR-CODE" data-layout="compact" data-theme="auto"></div>
<script src="https://opcilo.com/embed/card.js"></script>Resize the frame
card.js listens for postMessage and sets the iframe height. The message is { type: "opcilo-embed-height", height }. The height is a number from 40 to 400. It is not the seal result. The parent page cannot read or restyle the verdict inside the frame.
If you host the iframe yourself, accept the message only when event.origin is https://opcilo.com. Ignore every other origin and every other message type.
postMessage auto-resize
window.addEventListener("message", function (event) {
if (event.origin !== "https://opcilo.com") {
return;
}
var data = event.data;
if (!data || data.type !== "opcilo-embed-height" || typeof data.height !== "number") {
return;
}
var frame = document.querySelector("iframe[data-opcilo-frame]");
if (!frame || frame.contentWindow !== event.source) {
return;
}
var height = Math.min(400, Math.max(40, Math.round(data.height)));
frame.style.height = height + "px";
});Who can show the card
Developer API access requires Business, Enterprise, or an entitled custom plan.
The card is available on Pro, Team, Business, and Enterprise after an approved business verification. Free workspaces do not include the embeddable card.
Only a website address Opcilo has approved can show the card. Submit that address at /app/settings/verify-embed. Confidential seals do not get a snippet.
What this does not include
The Opcilo mark stays visible on the card. White-label removal of the mark is not part of this feature. Custom domains are not part of this feature.
This card is the live document result for one seal. It is not the Trust Badge.