Embed overview
Choose the right way to place a published Pollaris form on your website.
Publish the form first, then open Share → Embed in Pollaris and copy the generated snippet. If you use atomic one-page submission, also add every website origin that may submit the form.
Choose an integration
| Method | Effort | Design control | Branching forms | Best for |
|---|---|---|---|---|
| Responsive iframe | Lowest | Theme selection | Yes | Fast, isolated embeds |
| Styled mount | Low | Theme tokens | Yes | A ready-made form inside your page |
| Headless SDK | Medium | Complete | Yes | Fully custom step-by-step UI |
| One-page form | Medium | Complete | No | Contact, lead, and registration forms |
What you need
- A published Pollaris form and its share slug.
- The public API/forms/CDN URLs shown in Share → Embed.
- For one-page mode, an allowed website origin such as
https://www.example.com.
Embeds do not use account credentials. The form slug is public and identifies the published form. Never add an MCP key or Pollaris login token to frontend code.
Allowed origins
Pollaris checks the browser's exact origin when it loads a one-page manifest or sends an atomic one-page submission. Enter origins without paths or trailing slashes:
https://example.com
https://www.example.com
https://staging.example.comProduction origins must use HTTPS. Local development may use http://localhost:<port> or http://127.0.0.1:<port>. Wildcards and paths are not accepted, and each form supports up to 20 origins. Step-by-step forms use Pollaris's public respondent endpoints; the origin allowlist is specifically enforced for one-page mode.
If both example.com and www.example.com host the form, add both. If your preview platform creates a different subdomain per deployment, add only the exact preview origins you intend to trust.
Publishing and versioning
Embeds serve the current immutable published version. Draft edits do not affect visitors until you publish them. Existing response sessions continue to be interpreted against the version on which they started.
Browser security
- Public embed requests omit cookies and account Bearer tokens.
- Pollaris allows only narrow public form endpoints across origins.
- Submitted answer values are not included in SDK lifecycle events by default.
- Browser-side validation improves feedback, but Pollaris validates every answer again on the server.