Widget and embed

• Always use a publishable key (pk_…). data-channel picks the channel: public (end customer) or intermediary.
• With an intermediary key the widget always operates as that intermediary.
• Each channel is enabled per product (public widget and intermediary widget).

<script
  src="/widget/v1/embed.js"
  data-product-id="PRODUCT_ID"
  data-api-key="pk_live_…"
  data-channel="public"
  async
></script>

The widget tells your page about every quote, policy and payment: listen to the events on the script tag, or use onQuote, onPolicy and onPayment with the JS API.

const el = document.querySelector('script[src*="embed.js"]');
el.addEventListener('quore:quote', (e) => console.log(e.detail));
el.addEventListener('quore:policy', (e) => console.log(e.detail));
el.addEventListener('quore:payment', (e) => console.log(e.detail));

// quore:quote
{ quoteId, coverages, … }
// quore:policy
{ id, policyNumber, status, payment? }
// quore:payment
{ policyId, policyStatus, paymentMethodStatus, settling }

• quore:quote: every priced quote.
• quore:policy: the issued policy, with payment when the charge continues online.
• quore:payment: the outcome of a payment or a payment method registration inside the widget.

• To embed the intermediary widget inside your own portal, with the intermediary already identified.
• Your server signs intermediaryRef.timestamp.nonce (with a random nonce per page load) using HMAC-SHA256 and your account's embed signing secret, and renders the tag with the signature and the nonce.
• The signature is valid for 5 minutes and a single use; the widget exchanges it for a 15-minute session that refreshes itself.
• Use your account publishable key, not an intermediary key.

How it works: the intermediary is already signed in to your portal, so they never sign in to Quore again.

1. Your server, which already knows who is signed in, signs intermediaryRef.timestamp.nonce and renders the widget tag with that signature and the nonce.
2. The widget sends the signature to POST /api/embed/sessions. Quore checks the signature, its validity window and that it was never used before, then looks up the intermediary by their external reference.
3. Quore returns a 15-minute session that refreshes itself. The intermediary quotes and issues with their own view, products and commission.

What your team builds and what Quore handles:

• Your team: sign on your server (a few lines, with samples below) and load each intermediary’s external reference in Quore, which must be the same ID your portal uses. The signing secret must never reach the browser.
• Quore: verify the signature, create and refresh the session, enforce the hierarchy and permissions, quote, issue and collect payment.

Acting on behalf of a sub-producer: a higher-level intermediary can work as someone in their structure.

• To open the widget already acting as a sub-producer, send their external reference in data-acting-as-ref.
• The intermediary can also choose whom they represent from inside the widget.
• They can only choose intermediaries below them in the hierarchy, and Quore checks it again on every request. The session always has intermediary permissions, never administrator ones, even if the user is also an administrator.
• The quote and the policy belong to the represented intermediary and are priced with their commission. Quore also stores who actually operated (actorUserId) and records every session start in the audit log.

<!-- data-acting-as-ref (optional): reference of the sub-producer to preselect -->
<!-- data-quote-id (optional): reopens that saved quote directly at issuance -->
<script src="/widget/v1/embed.js"
  data-api-key="pk_live_..."
  data-product-id="PRODUCT_ID"
  data-intermediary-ref="<%= intermediaryRef %>"
  data-timestamp="<%= ts %>"
  data-signature="<%= sig %>"
  data-nonce="<%= nonce %>"
  data-acting-as-ref=""
  data-quote-id=""
  async
></script>

const crypto = require('crypto');
const ts = Math.floor(Date.now() / 1000);
const nonce = crypto.randomBytes(16).toString('hex');
const sig = crypto.createHmac('sha256', process.env.QUORE_EMBED_SECRET).update(`${intermediaryRef}.${ts}.${nonce}`).digest('hex');

Attributes, branding, prefill, JS API, payments and security. The fields you can prefill depend on each product.