SDKs

npm install @overturo/js

import { Overturo } from "@overturo/js"

const overturo = new Overturo({
  publishableKey: "pk_test_abc123"
})

import { Overturo } from "@overturo/js"

const overturo = new Overturo({ publishableKey: "pk_test_abc123" })

const handle = await overturo.consent.open({
  flowId: "flw_abc123",
  container: "#consent-container",
  onComplete: (outcome) => {
    console.log("Consent granted:", outcome.consentToken)
  }
})

typeof handle.destroy

import { Overturo } from "@overturo/js"

const overturo = new Overturo({ publishableKey: "pk_test_abc123" })

// Server mints the session; client just embeds with the token.
const session = await overturo.createSession({
  flowId: "flw_abc123",
  deliveryMode: "embed",
  embedOrigin: window.location.origin,
})

const widget = overturo.embed({
  sessionToken: session.sessionToken,
  container: "#consent",
  onComplete: (r) => console.log("granted:", r.consentToken),
})

// Or open in a popup:
// const popup = overturo.popup({ sessionToken: session.sessionToken })

// Or full-page redirect:
// overturo.redirect({ sessionToken: session.sessionToken })

window.addEventListener("message", (event) => {
  if (event.origin !== "https://overturo.com") return

  switch (event.data.type) {
    case "overturo:ready":
      console.log("Decision flow loaded; kind:", event.data.kind)
      break
    case "overturo:resize":
      iframe.style.height = event.data.height + "px"
      break
    case "overturo:state":
      // Visible state changed; payload is kind-specific.
      break
    case "overturo:complete":
      // Consent: outcome is "granted" or "denied".
      // Approval: outcome is "approve", "deny", or "counter".
      console.log("Decision outcome:", event.data.outcome)
      // Hand event.data.exchange_token to your backend; it's the source of truth.
      break
    case "overturo:cancel":
      console.log("User cancelled:", event.data.reason)
      break
    case "overturo:error":
      console.error("Flow error:", event.data.code, event.data.message)
      break
    case "overturo:deadline":
      // Server-pushed deadline tick (T-30s, T=0); update countdown UI.
      console.log("Remaining:", event.data.remaining_seconds, "seconds")
      break
  }
})

async function embedDecisionFlow(containerId, flowId) {
  // 1. Mint a decision token from your backend.
  const res = await fetch("/api/decision-session", {
    method: "POST",
    headers: { "Content-Type": "application/json" },
    body: JSON.stringify({ kind: "consent", flow_id: flowId })
  })
  const { decision_url, session_token } = await res.json()

  // 2. Drop the custom element (or create an iframe pointed at decision_url).
  const iframe = document.createElement("iframe")
  iframe.src = decision_url
  iframe.style.cssText = "width:100%; border:none; min-height:400px;"
  document.getElementById(containerId).appendChild(iframe)

  // 3. Listen for postMessage v2 events.
  window.addEventListener("message", (event) => {
    if (event.origin !== "https://overturo.com") return
    switch (event.data.type) {
      case "overturo:resize":
        iframe.style.height = event.data.height + "px"
        break
      case "overturo:complete":
        iframe.remove()
        // Hand exchange_token to your backend; verify via /api/v1/decisions/:token/exchange.
        onDecisionComplete(event.data.outcome, event.data.exchange_token)
        break
      case "overturo:cancel":
        iframe.remove()
        onDecisionCancelled(event.data.reason)
        break
    }
  })
}

await embedDecisionFlow("decision-container", "flw_abc123")

import { Overturo, OverturoApiError } from "@overturo/js"

const overturo = new Overturo({ publishableKey: "pk_test_abc123" })

await overturo.createSession({ flowId: "flw_doesnt_exist" })

import { Overturo } from "@overturo/js"

// ⚠ INTERNAL TOOLING ONLY. previewTemplate() reads internal state and
// requires the secret API key in the same execution context that mounts
// the iframe. Run this in a staging dashboard or admin UI you trust —
// never in code shipped to end users.
const overturo = new Overturo({
  publishableKey: "pk_test_abc123",
  apiKey: process.env.OVERTURO_API_KEY,
})

const preview = await overturo.previewTemplate({
  templateId: "tpl_abc123",
  container: "#preview",
})

// preview.setDevice("desktop" | "mobile")
// preview.setTheme("light" | "dark")
// preview.destroy()

import { Overturo } from "@overturo/js"

// Token exchange must run server-side — it requires the secret API key.
// (Use `pk_*` alone on the client; reach for `sk_*` only in trusted contexts.)
const overturo = new Overturo({
  publishableKey: "pk_test_abc123",
  apiKey: process.env.OVERTURO_API_KEY,
})

// Server-side flow:
//   1. createSession()  → hand the returned sessionToken to the browser
//   2. browser embeds the flow and receives a consentToken on completion
//   3. POST the consentToken back to your server, then exchange() it here
const result = await overturo.exchange({
  sessionToken: "ct_session_token_from_step_1",
  consentToken: "ct_consent_token_from_step_2",
})

result.claims
result.attestations
result.credentials

import { Overturo } from "@overturo/js"

const overturo = new Overturo({ publishableKey: "pk_live_…" })

// Your existing form keeps every input. Map each consent control to its purpose,
// name the email field, and let the snippet capture the decision at submit.
overturo.forms.attach({
  flowId: "flw_…",
  form: "#signup-form",
  map: { marketing: "#marketing_opt_in", analytics: "#analytics_opt_in" },
  subjectField: "#email",
  externalIdField: "#customer_id",            // optional: your own identifier
  labels: { marketing: "#marketing_label" },  // the label the person reads: its digest is attested (match / drift in the record)
  // wording: { marketing: "#marketing_label" }, // or: write the published wording into the label
  onCaptured: (r) => console.log("capture token", r.token, "wording", r.wordingVerdict),
  onError: (e) => console.warn("capture failed; the form submitted anyway", e.message),
})