Embed tokens
POST /embed-token. Let a registered website frame your checkout.
Mint an embed token
POSThttps://apps.apiswop.co/api/v5/merchant/embed-token
Scope: commerce.embed
Mints a short-lived token that lets one registered website frame one checkout (or your Swop cart). Register websites first in the Swop app under Dashboard → Developer; a key can't register them. Full guide: Framed checkout.
Body
| Field | Type | Required | Notes |
|---|---|---|---|
scope | string | No | "intent" (default) or "store" |
intentId | string | When scope is intent | A checkout you created with POST /checkout-intents |
storeHandle | string | When scope is store | Your Swop handle |
origin | string | Yes | The registered origin that will frame it, e.g. https://shop.acme.com. https only (http://localhost allowed), no path, query, fragment or wildcard. |
curl -X POST https://apps.apiswop.co/api/v5/merchant/embed-token \
-H "Authorization: Bearer $SWOP_MERCHANT_KEY" \
-H "Content-Type: application/json" \
-d '{ "scope": "intent", "intentId": "co_7Hk2mPq9xR4s", "origin": "https://shop.acme.com" }'Response
{
"state": "success",
"data": {
"token": "eyJzYyI6ImludGVudCIs….Q2x…",
"scope": "intent",
"origin": "https://shop.acme.com",
"expiresIn": 600
}
}| Field | Meaning |
|---|---|
token | Append as ?embed_token= to the framed URL |
scope | intent or store |
origin | The normalised origin the token is bound to |
expiresIn | Seconds: 600 for intent, 300 for store |
Errors
| Status | When |
|---|---|
400 | scope isn't intent or store; invalid origin; missing intentId/storeHandle; embedded checkout not configured on Swop's side |
403 | The origin isn't registered (https://shop.acme.com is not a registered embed origin for this merchant. Add it in the Swop app first.), or the key lacks commerce.embed |
Where to frame
scope | URL |
|---|---|
intent | https://www.swopme.app/checkout/{intentId}?embed_token=TOKEN (or the checkout's checkoutUrl) |
store | https://www.swopme.app/sp/{handle}/cart?embed_token=TOKEN |