veil

Call Veil from a website

Use fetch directly for public reads and message verification.

Public CORS endpoints accept requests from any origin without credentials. Use credentials set to omit if your fetch wrapper normally includes cookies. Your site’s Content Security Policy must allow connections to https://veil.rip.

javascript
const options = { credentials: "omit" };
const response = await fetch("https://veil.rip/o/veil.json", options);
if (!response.ok) throw new Error(`Veil replied ${response.status}`);
const card = await response.json();

Send a signature block#

javascript
const headers = new Headers();
headers.set("Content-Type", "application/json");
const response = await fetch("https://veil.rip/v1/verify", {
  method: "POST",
  credentials: "omit",
  headers,
  body: JSON.stringify({ block })
});
const verdict = await response.json();

The browser handles the OPTIONS preflight. A supported preflight returns 204 and can be cached for 600 seconds. Allowed request headers are Accept, Content-Type, Cache-Control, If-None-Match and If-Modified-Since. JavaScript can read Date, ETag when present, and Retry-After.

Handle failures#

Read the HTTP status before using the body. Public validation errors and rate limits are readable JSON. A private endpoint or a request with credentials will fail the browser’s CORS check. Signed writes, pairing codes and account-linking states have separate access requirements.

A cached image or script may retain headers from before CORS was enabled. A versioned resource URL requests a fresh response. Public JSON APIs and message verification do not use that static-resource cache.

Read this entry as JSON