Embed Widget

1. Script Tag

<!-- Use versioned + SRI snippet (see /widget/sri-snippet.html) -->
<script src="https://istampit.io/widget/v1.js" integrity="sha256-..." crossorigin="anonymous" async></script>

2. Container

<!-- Light Theme -->
<div data-istampit-verify data-mode="inline" data-theme="light"></div>

<!-- Dark Theme -->
<div data-istampit-verify data-mode="inline" data-theme="dark"></div>

<!-- Modal Mode -->
<div data-istampit-verify data-mode="modal" data-theme="dark">
  <button>Verify with iStampit</button>
</div>

3. Listen for Messages (optional)

// Parent page example
window.addEventListener('message', (e) => {
  if (e.origin !== 'https://istampit.io' && !e.origin.endsWith('.istampit.io')) return;
  if (e.data?.type === 'istampit:ready') {
    console.log('Widget ready');
  } else if (e.data?.type === 'istampit:verify:result') {
    console.log('Verification result:', e.data);
  } else if (e.data?.type === 'istampit:ui:height') {
    // Resize container if desired
  }
});

4. Security

• postMessage restricted to validated HTTPS origin (?origin= or referrer allowlist).
• No wildcard communication; invalid origin blocks messages.
• Use SRI integrity + versioned filename for supply-chain protection.
• Only hashes processed; files never leave device.