# Site builders

A site builder shows your page in the visitor's browser, so the rule is the opposite of the automation guides: you paste a widget rather than a key. Both snippets below were loaded from a page on an unrelated origin in Chrome on 2026-09-17 and rendered.

## Paste one of these

The plain iframe, when you know the size you want:

```html
<iframe src="https://api.astroway.info/v1/embed/moon-phase?theme=light&lang=en"
        width="320" height="360" style="border:0"></iframe>
```

The loader, when you would rather not size it: it replaces itself with an iframe and matches the height to the content over `postMessage`.

```html
<script src="https://cdn.astroway.info/embed.js"
        data-widget="moon-phase" data-lang="en" data-theme="light"></script>
```

Fifteen widgets, every parameter and a copy button for each are on [Embed widgets](/en/products/embed-widgets/). Any `data-*` attribute becomes a query parameter.

## Where the code goes

| Builder | What to look for |
|---|---|
| Wix | an [embed element for HTML code](https://support.wix.com/en/article/wix-editor-embedding-a-site-or-a-widget) |
| Squarespace | a [code block](https://support.squarespace.com/hc/en-us/articles/205815908-Code-blocks) |
| Shopify | a custom-liquid section, or the theme code editor |
| Webflow | an embed element |
| Tilda | the HTML-code block, T123 |

Wix and Squarespace links go to their own help centres; the other three name the feature, because their help pages refuse an automated check and we do not link to what we cannot open.

## No key, and none is accepted

The `/v1/embed/*` endpoints are public. A key in a page attribute would be readable by every visitor, so the loader ignores one and says so in the console.

Limits: **30 requests an hour per visitor IP**, and answers are cached for five minutes, so a page with many visitors is fine while one visitor reloading in a loop is not.

## What a page cannot call

Only `/v1/public/*` and `/v1/embed/*` answer a browser on someone else's domain. Everything under `/v1/*` refuses the preflight: measured from a page on an unrelated origin, `POST /v1/chart` came back with no `access-control-allow-origin` and Chrome blocked it, while `POST /v1/public/chart` answered `200` from the same page.

So if you want the visitor to type their own birth data and see a chart, use the [keyless endpoints](/en/free/) or the [natal chart calculator widget](/en/products/embed-widgets/#a-separate-widget-the-natal-chart-calculator), which computes in the browser. Anything that needs a secret key belongs on a server: your own backend, or one of the automation tools in [No-code integrations](/en/integrations/).

<Aside type="note" title="When a publishable key helps">
A `pk_` key is worth minting when your page calls `/v1/public/*` directly and the shared per-visitor limit is too tight: on a paid plan the key carries its own limit, and its origin list makes it worthless on any other domain. It changes nothing for the widgets above, which need no key at all.
</Aside>