Add it to a page
<script> tag. To place it somewhere
else on the page, put the element where you want it and the script will use it
instead of injecting its own:
Configuration
The panel inherits your page’s font stack and sizes itself to its container,
so it takes on your typography without shipping a webfont of its own.
Content Security Policy
If your site sends a CSP, the script embed needs two directives:img-src as well. That is a different host from www.closient.com —
product media is served from its own storage domain — so script-src and
connect-src do not cover it. Read the image_url field from the JSON
response for a product you carry and take the origin from there; the panel
omits the image cleanly if the request is blocked, so this directive is
optional.
If you cannot allow a third-party script
Use the iframe instead. It renders the same panel from Closient’s own origin and needs onlyframe-src:
What the panel sends
Nothing about your visitors, to anyone.- No cookies. The panel’s request is made with
credentials: 'omit', and no response it receives sets a cookie. Closient cannot recognise a visitor across your pages or anyone else’s. - No third-party requests. Every request the panel makes goes to Closient — the origin it was loaded from, plus Closient’s own media domain when the product has a photo. No analytics, no fonts, no third-party CDN, no map tiles.
- No client-side tracking. The panel fires no analytics event of any kind. Closient counts panel renders server-side, in aggregate, and those counts are tagged separately from real QR scans so they never inflate a brand’s scan numbers.
What the panel shows
Sometimes less than the full record, and always for a reason. Every response carries adisclosure value that says which case applies:
An empty
certifications list on a full response means the product has none.
On any other response it means Closient is not asserting them. Read
disclosure before drawing a conclusion from an empty field.
If Closient has no record of the GTIN at all, the panel renders nothing — not
an error box. An empty compliance panel is a worse shopping experience than no
panel.
The URL is the contract
/widget/v1/pip-panel.js is a version you pin, not a release number. Closient
ships fixes and improvements by replacing the asset behind that URL, so you get
them without touching your theme. The v1 changes only if the embed’s own
contract changes — attribute names, element name, the shape of what renders —
and a v2 would be published alongside v1, never in place of it.
Do not deep-link to the underlying static asset or to the JSON endpoint’s
internals; those are free to move.
Reading the data directly
If you would rather render the panel yourself, the same data is available as JSON. It is anonymous, open-CORS and cacheable:EmbedPanelOut under PIP Embed (Public) in the
Products API reference. Responses carry
Cache-Control: public, max-age=300, s-maxage=300 — please respect it rather
than polling.