Site builders
A site builder shows your page in the visitor’s browser, so the rule is the opposite of the automation guides: you paste a widget rather than a key. Both snippets below were loaded from a page on an unrelated origin in Chrome on 2026-09-17 and rendered.
Paste one of these
Section titled “Paste one of these”The plain iframe, when you know the size you want:
<iframe src="https://api.astroway.info/v1/embed/moon-phase?theme=light&lang=en" width="320" height="360" style="border:0"></iframe>The loader, when you would rather not size it: it replaces itself with an iframe and matches the height to the content over postMessage.
<script src="https://cdn.astroway.info/embed.js" data-widget="moon-phase" data-lang="en" data-theme="light"></script>Fifteen widgets, every parameter and a copy button for each are on Embed widgets. Any data-* attribute becomes a query parameter.
Where the code goes
Section titled “Where the code goes”| Builder | What to look for |
|---|---|
| Wix | an embed element for HTML code |
| Squarespace | a code block |
| Shopify | a custom-liquid section, or the theme code editor |
| Webflow | an embed element |
| Tilda | the HTML-code block, T123 |
Wix and Squarespace links go to their own help centres; the other three name the feature, because their help pages refuse an automated check and we do not link to what we cannot open.
No key, and none is accepted
Section titled “No key, and none is accepted”The /v1/embed/* endpoints are public. A key in a page attribute would be readable by every visitor, so the loader ignores one and says so in the console.
Limits: 30 requests an hour per visitor IP, and answers are cached for five minutes, so a page with many visitors is fine while one visitor reloading in a loop is not.
What a page cannot call
Section titled “What a page cannot call”Only /v1/public/* and /v1/embed/* answer a browser on someone else’s domain. Everything under /v1/* refuses the preflight: measured from a page on an unrelated origin, POST /v1/chart came back with no access-control-allow-origin and Chrome blocked it, while POST /v1/public/chart answered 200 from the same page.
So if you want the visitor to type their own birth data and see a chart, use the keyless endpoints or the natal chart calculator widget, which computes in the browser. Anything that needs a secret key belongs on a server: your own backend, or one of the automation tools in No-code integrations.