Security & licensing

Scalarcut is built for stores that run real checkouts, so the widget is scoped tightly to your domains and your catalog.

Widget keys are bound to your origins

Your widget key only loads on the origins you register with your account. A key copied to another domain simply does not render — the widget cannot be framed on a site you do not own, and a leaked key is not a working embed anywhere else.

When you add a store or a new domain, add it to your account's origin list. No code changes needed.

Tokens are short-lived and scoped

The widget and API use signed tokens that carry your enterprise id, the widget key id, and the catalog they may touch. Tokens expire after seven days and are issued by the widget at load time, so your server never has to store long-lived secrets.

• The embed token is scoped to a single enterprise and catalog.
• Cart intent and estimate calls validate the token before touching any catalog data.
• Usage is recorded per event, so every estimate and add-to-cart is attributable to a store.

HTTPS everywhere

The widget, the SDK, and the API are served over HTTPS, and catalog image URLs are accepted only as public HTTPS. In production the parent page must be HTTPS, matching the widget's secure frame.

Frame protections

The widget's response sets frame-ancestors to your registered origins. Browsers enforce this through the Content-Security-Policy header, so only your domains can host the iframe — no other site can frame the planner, even with a valid-looking URL.

Message origin checks

The SDK verifies the origin of every postMessage before acting, in both directions. A page outside your registered origins cannot send commands to the widget, and the widget will not deliver cart lines to an untrusted listener.

Checkout authority stays with you

Security also means the widget cannot do anything with money. It holds no payment credentials, no customer data, and no way to place an order. It resolves SKUs and quantities; your store — with your authentication, your stock, and your payment provider — is the only place an order is created.

Rotation and revocation

Widget keys can be rotated or revoked from your dashboard at any time. A revoked key stops serving immediately, and its tokens stop validating on the next request.