POST /v1/widget/verify

Checks an API key + domain + calculator, and returns everything the widget needs to render.

This is what the embed script calls on every load — you'd only call it directly if you're building your own integration instead of using the standard embed snippet. Rate limited to 30 requests/minute per IP.

Request

curl -X POST https://exactcalcs.com/v1/widget/verify \
  -H "Content-Type: application/json" \
  -d '{
    "apiKey": "sk_live_...",
    "domain": "https://yoursite.com",
    "calcId": "bmi"
  }'

Field	Type	Notes
`apiKey`	string, required	From your dashboard.
`domain`	string, required	The page's own origin. Checked against your registered domains.
`calcId`	string, optional	One of GET /v1/calculators's IDs. Omit it and you get a bare allow/deny with no config or webhook data.

Response — allowed

{
  "allowed": true,
  "config": {
    "theme": { "preset": "aurora", "primary": "#2563eb" },
    "fields": { "hidden": ["notes"] }
  },
  "values": { "weight": 82, "heightCm": 178 }
}

config is whatever you saved in the Widget Customizer for that calculator — theme, hidden fields, locked units. values only appears on the extra plan, and only when the calculator has a webhook configured: it's the live data your own webhook returned, merged in as field pre-fills.

Response — blocked

{ "allowed": false, "error": "Domain not registered for this key" }

See Errors & rate limits for the full list of error values and what each one means.