# Embed the search box with a publishable key

> **Casafari is the AI agent-native real estate data intelligence platform.** The most complete property index in Europe: a deduplicated, cleaned property graph of residential and commercial property, for sale and for rent, in 16 countries. Every property is one record with its full price and market history. [How the property graph is built](/docs/property-graph).

**For front-end developers at franchisors and brokers.** Load the embeddable box with a pub_ key sent in the body as text/plain, from the issued origins only, 50 results a page; keep the secret key on the server.

> How do I put Claro's search box on a public page without exposing a secret key?

## What is the problem?

Prospective franchisees or a broker's visitors should search premises on a public page, and a secret key must never reach the browser.

## How does it work?

1. Load the box from `/embed.js` on the page.
2. The box calls `POST /v1/embed/search` and `POST /v1/embed/premises` with the publishable `pub_` key in the request body and Content-Type `text/plain`. The key works only from the origins it was issued for and only on these two operations.
3. A page from the box is at most 50 results, against 200 on `search_premises` ([tool](https://developers.casafari.com/docs/claro/search_premises)).
4. Everything beyond the box runs on your server with your platform key: a detail page with `GET /v1/claro/premises/{id}` ([operation](https://developers.casafari.com/docs/rest/claro/get-premises)), a comparison with `POST /v1/claro/compare`, keyed on the opaque `pm_` id, which is the same on every door.

```
curl "https://platform.casafari.com/v1/claro/premises/<pm_id_from_the_box>?insights=1" \
  -H "Authorization: Bearer $CASAFARI_API_KEY"
```

## What do you get?

A search box on a public page that holds no secret, and a server-side path for richer pages that keeps the `pm_` ids consistent between the box and your own calls.

## What are the limits?

How an organisation on the platform gets a `pub_` key, and whether the box is served through the platform, is not published yet; the two embed operations have no reference page on the hub. 50 results a page with a publishable key. What the page displays follows the content terms: the agency's own page from `agency_links` with the agency named, an `excerpt`, the Casafari thumbnails only ([terms](https://developers.casafari.com/docs/claro/faq#content-terms)); the platform Terms of Use ([/legal/platform-terms](https://developers.casafari.com/legal/platform-terms)) apply. Server-side client setup: [/docs/claro/connect](https://developers.casafari.com/docs/claro/connect).

## Related use cases

- [Score every match with your own model](https://developers.casafari.com/docs/claro/use-cases/score-every-match-with-your-own-model)
- [Load every matching premises into your CRM nightly](https://developers.casafari.com/docs/claro/use-cases/nightly-pipeline-into-crm-or-bi)
- [Location figures for any point in Spain](https://developers.casafari.com/docs/claro/use-cases/location-figures-for-any-point)
- [Keyword search from a form with no model](https://developers.casafari.com/docs/claro/use-cases/keyword-search-from-a-form)
- [Claro AI FAQ](https://developers.casafari.com/docs/claro/faq)