Embed the search box with a publishable key
For front-end developers at franchisors and brokers. Load the embeddable box with a pub_ key sent in the body as text/plain, from the issued origins only, 50 results a page; keep the secret key on the server.
What is the problem?
Prospective franchisees or a broker's visitors should search premises on a public page, and a secret key must never reach the browser.
How does it work?
- Load the box from
/embed.json the page. - The box calls
POST /v1/embed/searchandPOST /v1/embed/premiseswith the publishablepub_key in the request body and Content-Typetext/plain. The key works only from the origins it was issued for and only on these two operations. - A page from the box is at most 50 results, against 200 on
search_premises(tool). - Everything beyond the box runs on your server with your platform key: a detail page with
GET /v1/claro/premises/{id}(operation), a comparison withPOST /v1/claro/compare, keyed on the opaquepm_id, which is the same on every door.
curl "https://platform.casafari.com/v1/claro/premises/<pm_id_from_the_box>?insights=1" \
-H "Authorization: Bearer $CASAFARI_API_KEY"What do you get?
A search box on a public page that holds no secret, and a server-side path for richer pages that keeps the pm_ ids consistent between the box and your own calls.
What are the limits?
How an organisation on the platform gets a pub_ key, and whether the box is served through the platform, is not published yet; the two embed operations have no reference page on the hub. 50 results a page with a publishable key. What the page displays follows the content terms: the agency's own page from agency_links with the agency named, an excerpt, the Casafari thumbnails only (terms); the platform Terms of Use (/legal/platform-terms) apply. Server-side client setup: /docs/claro/connect.