The two embeds
Which embed you need depends on who's looking at it.
InsurGrid has two embeds, and they're easy to confuse because both put InsurGrid inside your product. The difference is who they're for.
One is for your users — the people who work for you, building and editing intake forms. The other is for their customers — the people filling those forms in. They authenticate differently, you install them differently, and they behave differently once they're running.
Who uses it
Your signed-in users, building a form
Their customers, filling one in
Do they need to be logged in?
Yes — into your app
No. Anyone with the address can fill it in
How you install it
A <script> snippet plus a route on your server
A plain <iframe>
How it's opened
The script fetches a short-lived token from your route
A stable public address with ?embed=1
What it tells your page
Browser events — insurgrid:ready, form-saved, form-published, close, error
Nothing at all
Where the data goes
Into the same forms your API sees
To your webhook
The builder embed
For the people on your side who maintain forms.
It's a snippet, not a URL you generate. You paste it into a page behind your login, and the script asks your own server for a short-lived token — that's how it knows which of your users it's showing forms to. Your API key never reaches the browser.
<div id="insurgrid-forms"></div>
<script
src="https://dashboard.insurgrid.com/embed.js"
data-token-url="/insurgrid-token">
</script>Each user sees only their own forms, and nothing the browser sends can change that — ownership comes from the token, which comes from your login session.
It reports back through ordinary browser events on the container, so there's no message listener to write and no origin to verify:
Full walkthrough: Embed the form builder.
The fill form embed
For the prospect or customer completing the form.
No login, no token, no snippet — just an iframe pointed at the form's own address, which you get as shareUrl from the Forms API.
?embed=1 strips InsurGrid's header and page furniture so only the form shows. The first segment is the slug of the agent who created the form, and that's who the submission is credited to. shareUrl is null until the form is published, and nothing needs registering before you frame it.
This embed is silent. It sends your page no events of any kind, so give the frame a fixed height that suits your layout rather than waiting for it to tell you its size.
Full walkthrough: Quickstart B.
Where the submission actually goes
Neither embed hands you the data through the browser. When someone completes a form, the whole submission — every answer, file links, and any filled ACORD forms — is delivered to your webhook endpoint as a form-submission event.
That keeps it off the browser, where it could be read or altered in transit. The Forms API doesn't return submissions either, so treat the webhook as the delivery and store what you need when it lands. See Submissions.
Related
Embed Loss Runs — the same snippet mechanism, for loss runs