You signed in with another tab or window. Reload to refresh your session.You signed out in another tab or window. Reload to refresh your session.You switched accounts on another tab or window. Reload to refresh your session.Dismiss alert
{{ message }}
Repository navigation
Commit 9dc63f6
Browse filesBrowse the repository at this point in the historyBrowse files
Add a <strong>DOCX, XLSX, PPTX and CSV</strong> editor to your product with a single iframe and a
197
-
<strong>postMessage</strong> API. Your app keeps auth, file access and upload — the editor just edits, and
198
-
never sees your users' tokens.
202
+
<strong>postMessage</strong> API. Your app keeps auth, file access and upload — the editor just edits, and never
203
+
sees your users' tokens.
199
204
</p>
200
205
201
206
<aclass="cta" href="/embed-demo.html"><r-buttontype="contrast">Open the live demo →</r-button></a>
@@ -231,7 +236,9 @@ <h2>What you get</h2>
231
236
<ul>
232
237
<li>One iframe + a small <strong>postMessage</strong> command/response API — no SDK to install</li>
233
238
<li>Open from a <strong>URL, a File, or an ArrayBuffer</strong> your app fetched with its own credentials</li>
234
-
<li>Save back to <strong>XLSX, DOCX, PPTX or CSV</strong>, returned as a <code>File</code> for your app to upload</li>
239
+
<li>
240
+
Save back to <strong>XLSX, DOCX, PPTX or CSV</strong>, returned as a <code>File</code> for your app to upload
241
+
</li>
235
242
<li>Read-only mode, per-message origin locking (<code>embedOrigin</code>), and a state query</li>
236
243
<li>No document server to run — editing is 100% client-side WebAssembly</li>
237
244
<li>Open source (AGPL-3.0) and self-hostable — embed it under your own domain</li>
@@ -240,38 +247,61 @@ <h2>What you get</h2>
240
247
<h2>How it works</h2>
241
248
<ol>
242
249
<li>Add the iframe pointing at the editor with <code>?embed=1</code>, sized to your layout.</li>
243
-
<li>Wait for the <code>document:ready</code> event, then send <code>document:open-url</code>, <code>open-file</code> or <code>open-buffer</code>.</li>
250
+
<li>
251
+
Wait for the <code>document:ready</code> event, then send <code>document:open-url</code>,
252
+
<code>open-file</code> or <code>open-buffer</code>.
253
+
</li>
244
254
<li>The user edits in place; the file never leaves the browser unless your app sends it somewhere.</li>
245
-
<li>Send <code>document:save</code>; the editor returns the edited file via <code>document:saved</code>, which your app uploads with its own auth.</li>
255
+
<li>
256
+
Send <code>document:save</code>; the editor returns the edited file via <code>document:saved</code>, which
257
+
your app uploads with its own auth.
258
+
</li>
246
259
</ol>
247
260
248
261
<r-cardclass="oss"
249
262
><divclass="card-body">
250
263
<strong>Open source & self-hostable.</strong> Under AGPL-3.0 — read the code, run your own copy, and see
251
-
exactly how the boundary works: <ahref="https://github.com/ranuts/document" rel="noopener">github.com/ranuts/document</a>.
252
-
Full API reference:
264
+
exactly how the boundary works:
265
+
<ahref="https://github.com/ranuts/document" rel="noopener">github.com/ranuts/document</a>. Full API
<p>Add one iframe pointing at the editor with <code>?embed=1</code>, then drive it with a postMessage API to open and save documents. A working demo is at <ahref="/embed-demo.html">/embed-demo.html</a>.</p>
274
+
<p>
275
+
Add one iframe pointing at the editor with <code>?embed=1</code>, then drive it with a postMessage API to open
276
+
and save documents. A working demo is at <ahref="/embed-demo.html">/embed-demo.html</a>.
277
+
</p>
261
278
<h3>Does the editor see my users' auth tokens?</h3>
262
-
<p>No. Auth, file fetching and upload stay in your app — your app fetches the file with its own credentials and passes the bytes to the editor, so tokens and cookies never enter the iframe.</p>
279
+
<p>
280
+
No. Auth, file fetching and upload stay in your app — your app fetches the file with its own credentials and
281
+
passes the bytes to the editor, so tokens and cookies never enter the iframe.
282
+
</p>
263
283
<h3>Which file formats can the embedded editor handle?</h3>
264
-
<p>DOCX, XLSX, PPTX and CSV, edited client-side with the OnlyOffice WebAssembly engine. The save command exports to XLSX, DOCX, PPTX or CSV.</p>
284
+
<p>
285
+
DOCX, XLSX, PPTX and CSV, edited client-side with the OnlyOffice WebAssembly engine. The save command exports
286
+
to XLSX, DOCX, PPTX or CSV.
287
+
</p>
265
288
<h3>Can I self-host it or use it white-label?</h3>
266
-
<p>Yes. It's open source under AGPL-3.0 and ships as static files, so you can host your own copy and embed it under your own domain.</p>
289
+
<p>
290
+
Yes. It's open source under AGPL-3.0 and ships as static files, so you can host your own copy and embed it
291
+
under your own domain.
292
+
</p>
267
293
<h3>How do I restrict which site can talk to the editor?</h3>
268
-
<p>Add <code>embedOrigin</code> to the iframe URL to lock messaging to a specific origin, and verify <code>event.origin</code> in your own message handler.</p>
294
+
<p>
295
+
Add <code>embedOrigin</code> to the iframe URL to lock messaging to a specific origin, and verify
296
+
<code>event.origin</code> in your own message handler.
0 commit comments