Iframe embedding

Before you start

⚠️

Origin allow-list required

By default the checkout responds with Unauthorized — this page cannot be embedded from this origin when loaded inside an <iframe>. Send us the origin (or list of origins) you plan to embed from and we'll allow them.

📘

Same customization as the standalone checkout

Form appearance, locale, payment methods and branding are configured the same way as the standalone checkout — see Hosted Checkout customization.

Embedding

<iframe
  src="https://checkout.carusell.world/s/{sessionId}"
  width="100%"
  height="720">
</iframe>

Inside an iframe:

• All outbound links open in a new tab.
• The Back to store button emits a postMessage instead of navigating.

Listening to events

The iframe posts messages to the parent window. PaymentInfo (used as payload by several events):

{
  paymentMethod: CARD,
  paymentId: string,
  paymentStatus: AUTHORIZED,
}

Events

Every event carries sessionId and intentId at the top level. Only payload varies between events.