MetaPhrase.
Open workspace
Browse documentation
METAPHRASE / GUIDESREST API v1
Open in AI
Open in ChatGPT Open in Claude
Markdown

Embeddable paraphraser widget

Add a MetaPhrase writing box with one script tag and no frontend secret key.

  1. Sign in to the dashboard and create a secret API key for the widget's quota.
  2. Under Embeddable widgets, select Create widget.
  3. Choose the linked key and enter exact allowed website origins, for example https://example.com and https://www.example.com. Do not include paths or wildcards.
  4. Copy the generated script to the part of the page where the box should appear.
<script async src="https://metaphrase.msalman.com/widget.js" data-widget-id="mpw_REPLACE_WITH_YOUR_PUBLIC_WIDGET_ID"></script>

Replace only the public widget ID with the value generated by your dashboard. Never put the secret API key in this tag. Each tag inserts a responsive iframe after itself. The iframe is titled for accessibility, uses the website's light/dark preference, and supports seven paraphrasing modes, result copy and clear errors.

The iframe is served from MetaPhrase. An explicit CSP frame-ancestors policy restricts which sites may embed it. Public IDs are not authentication secrets: the origin list controls browser embedding, while quotas, per-IP limits and heavy-use verification control abuse. Requests share the linked secret key's API quota and the free-web IP limits. Revoking a widget disables that public box; revoking its linked API key disables every linked widget.

Heavy use may display a Turnstile challenge. Without operator-configured Turnstile credentials, the free daily threshold stops further requests until reset. Missing LLM credentials produce a clear provider-unavailable error rather than a simulated rewrite.

If the box does not appear, confirm that the ID is active, its linked key is active, your origin including scheme/port is allowed, and your site's CSP permits scripts and frames from https://metaphrase.msalman.com. Use an actual HTTP(S) site for development; file:// pages have an unsupported null origin. No backend secret is needed in the embedding site.