Build with FaceAuraAI

Embed widget & REST API

Partner embed widget (allowlisted origins only)

The iframe embed surface stays curated by design — this is a CSP frame-ancestors boundary, a different security concern than the REST API below, so only origins added to the partner allowlist can embed the widget. Example below uses the current reference partner (e11-pilot); to onboard a new partner origin, see the operator runbook.

Iframe snippet

Copy into your partner page. Replace the origin when you move from staging to production.

<iframe
  src="https://faceauraai.com/embed/face-shape?partnerId=e11-pilot"
  title="FaceAuraAI face shape detector"
  width="100%"
  height="640"
  loading="lazy"
  referrerpolicy="strict-origin-when-cross-origin"
  allow="camera 'none'"
></iframe>

Query parameters

• partnerId=e11-pilot — required for referral attribution in telemetry (INV-8).
• Alternate: /ai-tools/face-shape-detector?embed=true&partnerId=… strips site chrome on the full detector route (same guest scan limits).

REST API (public)

Server-to-server analysis with your own API key — no allowlist, no partner registration. Sign in above to generate a key; your existing plan (or a free account) sets your request quota and rate limit.

curl -sS "https://faceauraai.com/v1/health"

curl -sS -X POST "https://faceauraai.com/v1/analyze/face" \
  -H "Authorization: Bearer YOUR_API_KEY" \
  -H "Content-Type: application/json" \
  -d '{"image":"BASE64_JPEG_HERE"}'

What we commit to

• Same classify() path as the web face-shape detector (INV-2 router) — not a separate model.
• Monthly quota per plan plus per-minute rate limit; exhausted quota returns 429 QUOTA_EXCEEDED, burst traffic returns 429 RATE_LIMIT_EXCEEDED.
• No image persistence on the API path (INV-5).
• GET /v1/health checks process + Postgres only — not a marketed uptime SLA or availability percentage.
• Analyze confidence is a geometry-fit score, not accuracy % (N-01, INV-3).

When monthly quota is exhausted, analyze endpoints return 429 with QUOTA_EXCEEDED. Guest embed scans remain capped at 2/day (D-07).

Operator runbook: docs/operations/embed-partner-pilot.md