Widget page — the iframe content
GET /Card/Sbp/widget.html
What mount() inserts into the iframe: the amount, the QR code, a countdown
and status polling. You do not open it yourself — the SDK builds the URL.
Branding parameters are sanitized on the server: the page is public and brand
arrives in the query string — without validation this is reflected XSS. An invalid
value is silently replaced with the default: this is the payer’s screen, and an
error instead of a payment form is worse than a missing logo.
An invalid token yields a screen, not JSON: the payer sees the iframe content.
Request parameters
| Field | Type | Required | Description |
|---|---|---|---|
invoiceId | string | yes | Invoice identifier |
t | string | yes | The AuthorizationToken from the createInvoice response. The parameter is named t (the sandbox also accepts the previous name token). |
name | string (≤64) | — | Shop name shown on the screen (trimmed to 64 characters) |
logo | string | — | Logo — only http(s):// or data:image/ is accepted |
primary | string | — | Accent color — #rgb, #rrggbb, rgb()/rgba() or a whitelisted name |
bg | string | — | Background color (the previous name background is still accepted) |
textColor | string | — | Text color |
poll | 1 · 0 | — | Status polling; 0 turns it off (false is accepted too) |
lang | ru · en | — | Screen language — a sandbox extension, its pages are bilingual |
Response codes
| Code | Description |
|---|---|
200 | The widget page |
401 | The token did not match — an “invalid link” screen |