# Embed the search box with a publishable key

> **Casafari is the AI agent-native real estate data intelligence platform.** The most complete property index in Europe: a deduplicated, cleaned property graph of residential and commercial property, for sale and for rent, in 16 countries. Every property is one record with its full price and market history. [How the property graph is built](/docs/property-graph).

**For front-end developers at a franchisor or a broker.** Load /embed.js with a pub_ key for a public search box, 50 results a page, and keep every other operation on your server.

> How do I put a premises search box on a public page without exposing a secret key?

## What is the problem?

Visitors to a public page, such as prospective franchisees, should search commercial premises there, and no secret key may reach the browser.

## How does it work, step by step?

1. Load the box from `/embed.js` with a publishable `pub_` key. The key works only from the origins it was issued for.
2. The box calls `POST /v1/embed/search` and `POST /v1/embed/premises` with the `pub_` key in the request body and Content-Type `text/plain`; a page is at most 50 results. These two operations have no reference page on the hub, and a `pub_` key does not work on any other operation.
3. Anything beyond the box (a detail page with up to 8 thumbnails from [get_premises](https://developers.casafari.com/docs/claro/get_premises), [compare_premises](https://developers.casafari.com/docs/claro/compare_premises), [market_snapshot](https://developers.casafari.com/docs/claro/market_snapshot), [explain_location](https://developers.casafari.com/docs/claro/explain_location), your store list) runs on your server with the platform key ([connect](https://developers.casafari.com/docs/claro/connect)). The `pm_` ids are the same tokens on every door.

```bash
# server side, after a click in the box
curl https://platform.casafari.com/v1/claro/premises/$PREMISES_ID \
  -H "Authorization: Bearer $CASAFARI_API_KEY"
```

## What do you get?

A search box on your page with up to 50 results a page, `pm_` ids you can pass to your server, and a server-side path for everything else ([REST](https://developers.casafari.com/docs/rest/claro/get-premises)).

## What are the limits?

50 results a page with a publishable key (up to 200 server side). How an organisation on the platform gets a `pub_` key, and whether the box is served through the platform, is not published yet. The page follows the content terms: name the agency and link only its page, show excerpts rather than full descriptions, Casafari thumbnails only, never a private seller, never a portal ([content terms](https://developers.casafari.com/docs/claro/faq#content-terms), [/legal/platform-terms](https://developers.casafari.com/legal/platform-terms)). Keep the platform key out of the browser, URLs and repositories.

## Related use cases

- [Score every premises with your own agent](https://developers.casafari.com/docs/claro/use-cases/score-premises-with-your-own-agent)
- [Load every match into a CRM or warehouse nightly](https://developers.casafari.com/docs/claro/use-cases/nightly-pipeline-into-crm-or-bi)
- [Get location figures for any point in Spain](https://developers.casafari.com/docs/claro/use-cases/explain-any-point-in-spain)
- [Keyword search from a simple form, no model](https://developers.casafari.com/docs/claro/use-cases/keyword-search-from-a-form)
- [Claro AI FAQ](https://developers.casafari.com/docs/claro/faq)