Widget without a backend

Four ways to integrate: headless, bridge, the hosted widget, and the widget without a backend.

Publishable key only

Widget origin: …
This page mounts with publishableKey and does not call POST /session. The iframe mints by itself only when no-backend minting is on for that key. The option is off by default. Turn it on in Design Studio after saving an allowed origin. This path is best-effort: 1inch can throttle it or turn it off, and the embed says the widget is not available when the product flags are off. A session that must stay available should mint with the secret key from your own backend.

Code snippet

…

Pros and cons

Customer effort

  • Pro: no mint endpoint to run. One script, one mount() call, and a publishable key.
  • Con: no-backend minting is off by default. Turn it on in Design Studio for this publishable key after saving an allowed origin.
  • Con: this path is best-effort. 1inch can throttle it or turn it off. When the product flags are off, the embed says the widget is not available. A session that must stay available should mint with the secret key from your own backend.

Customer security

  • Pro: the secret key never ships to the browser. The session's origins, lifetime, and scopes stay on the server.
  • Con: the publishable key is public. Proof of work, the monthly widget share, and per-session limits are what hold a script back. The monthly share must stay below 100 percent while no-backend minting is on.
  • Con: you still trust the loader and iframe, and a compromised page can ask the iframe to mint.

Event log