Widget page — the iframe content
GET /Cards/Sbp/widget.html
What mount() inserts into the iframe. Branding arrives as query parameters and
is sanitized on the server: the page is public, and without validation this is
reflected XSS. An invalid value is silently replaced with the default — this is
the payer’s screen.
The legal notices (subscription terms and data processing consent) exist in this
flow only; in the sandbox they lead to the /Cards/Sbp/legal/{doc} stubs.
Before the payment the page shows the amount incl. VAT and the subscription
period. The method set is the project setting adjusted to the subscription terms:
T-Pay is temporarily off, a deferred first payment offers SBP only. methods
only narrows the set, webview=1|0 is the shop app flag. Once the operation has
started the method cannot be
changed (canChangeMethod=false in the page config, the switch link is hidden);
after a reload the choice screen may appear again, and only the same method
continues the operation.
Request parameters
| Field | Type | Required | Description |
|---|---|---|---|
token | string | yes | The value from the CreateSubscription AuthorizeUrl |
name | string (≤64) | — | Shop name shown on the screen (trimmed to 64 characters); defaults to “Payment” |
logo | string | — | Logo — only http(s):// or data:image/ is accepted |
primary | string | — | Accent color — #rgb, #rrggbb, rgb()/rgba() or a whitelisted name |
bg | string | — | Background color (the previous name background is still accepted) |
textColor | string | — | Text color; by default picked from the background |
poll | 1 · 0 | — | Status polling; 0 turns it off (false is accepted too) |
lang | ru · en | — | Screen language — a sandbox extension, its pages are bilingual; the subscription SDK does not pass it |
Response codes
| Code | Description |
|---|---|
200 | The widget page |
401 | The token did not match — an “invalid link” screen |