Embedded Form

A form publication gives a deployed workflow a stable, shareable URL (/form/<identifier>) that renders as an input form. Visitors fill in the form and submit; Scrydon runs the workflow in the background and returns an acknowledgment. The page can be loaded directly in a browser or embedded in any website via an <iframe>.

Creating a form publication

At minimum you need:

• The workflow identifier (visible in the editor URL).
• The deployment id you want to pin (get it from the Deployments panel).
• Your chosen auth mode (public or password).
• One or more allowed embed origins (https only; required to enable iframe embedding).

// Using @scrydon/sdk
const pub = await scrydon.forms.create({
  workflowId: "wf_...",
  deploymentId: "dep_...",
  authType: "public",           // or "password"
  allowedEmbedOrigins: ["https://yoursite.com"],
});

console.log(pub.url); // https://app.scrydon.com/form/<identifier>

The identifier in the returned URL is a high-entropy random string generated by the server. It cannot be guessed. Share it only with intended users — there is no separate access list; possessing the URL is the access credential for public mode.

Auth modes

Public

Anyone with the link can submit the form. Choose this when:

• The workflow collects publicly available information (contact forms, event registrations, support requests).
• You control access through the embed page itself (e.g., a logged-in portal).

Password

Visitors must enter a password before the form is shown. Choose this when:

• You need a lightweight gate without a full SSO flow.
• The workflow collects sensitive information.

const pub = await scrydon.forms.create({
  workflowId: "wf_...",
  deploymentId: "dep_...",
  authType: "password",
  password: "replace-with-a-strong-passphrase",
  allowedEmbedOrigins: ["https://yoursite.com"],
});

Passwords are hashed with Argon2id and verified in constant time. Rotating the password immediately invalidates any existing visitor sessions.

Embedding the form

Add the snippet below to your page. Replace <identifier> with the value returned by the API.

<iframe
  src="https://app.scrydon.com/form/<identifier>"
  sandbox="allow-scripts allow-forms allow-same-origin"
  referrerpolicy="no-referrer"
  style="border:0;width:100%;height:640px"
  title="Workflow form"></iframe>

The sandbox attributes are the minimum required for the form to function:

Do not add allow-top-navigation or allow-popups-to-escape-sandbox unless your workflow specifically requires them.

Allowed embed origins

Scrydon enforces a strict embed allowlist. A form can only be framed by origins you explicitly authorise — the default is deny all frames.

await scrydon.forms.update(pub.id, {
  allowedEmbedOrigins: [
    "https://yoursite.com",
    "https://portal.yoursite.com",
  ],
});

Rules:

• Origins must start with https:// in production.
• Only the bare origin is matched — path and query parameters are ignored.
• Wildcards (*) are never accepted, including subdomain wildcards like https://*.yoursite.com. List each origin explicitly.
• The hostname must be an ordinary public hostname. Private, loopback, and cloud-metadata addresses (10.x, 192.168.x, 127.0.0.1, 169.254.169.254, …) are rejected, as is anything containing characters that are not valid in a hostname.
• An empty list means the form cannot be embedded anywhere (it can still be opened as a standalone page).

The server sets Content-Security-Policy: frame-ancestors 'self' <your origins> on the form page so browsers enforce the restriction.

Standalone page

Every form publication is also a standalone page. Share https://app.scrydon.com/form/<identifier> directly and visitors open it in a full browser tab without any iframe.

Managing publications

// List all form publications for a workflow
const pubs = await scrydon.forms.list({ workflowId: "wf_..." });

// Delete (immediately deactivates the URL — returns 404 to any visitor)
await scrydon.forms.delete(pub.id);

Deleting a publication is permanent. The identifier is never reused.

Troubleshooting