Request an age claim through a supported CAIRL flow

See it run

The live embed demo activates when the checkbox widget is enabled in this environment — it is not enabled anywhere today. To integrate identity verification now, use the OAuth quickstart.

The intended snippet

Shown for review — the script it loads is not served yet, so this does not run today. Once it ships you will swap pk_sandbox_your_key_here for your publishable key and data-cairl-redirect for your callback URL. Full walkthrough in the integration guide.

Redirect mode (default)

Full-page hand-off to CAIRL, then back to your callback with an OAuth authorization code and your state, which your backend exchanges for claims. Simplest and most robust.

<!-- 1. Drop a checkbox host where the verification should appear -->
<div
  data-cairl-checkbox
  data-cairl-key="pk_sandbox_your_key_here"
  data-cairl-redirect="https://yourstore.example/age-callback"
  data-cairl-profile="age-gate-21"
  data-cairl-mode="redirect"
></div>

<!-- 2. Load the CAIRL widget once, anywhere on the page -->
<script src="https://cairl.app/v1/checkbox.js" async></script>

Iframe mode

The verification opens in a CAIRL-hosted overlay; the visitor never leaves your page. Your page receives the result via cairl:complete / cairl:error DOM events.

<div
  data-cairl-checkbox
  data-cairl-key="pk_sandbox_your_key_here"
  data-cairl-redirect="https://yourstore.example/age-callback"
  data-cairl-profile="age-gate-21"
  data-cairl-mode="iframe"
></div>
<script src="https://cairl.app/v1/checkbox.js" async></script>

<script>
  // The widget dispatches DOM events you can listen for in iframe mode.
  document.addEventListener("cairl:complete", function (e) {
    // e.detail = { canonicalClaimIds, sessionRef, modeType, profileLabel }
    console.log("verified", e.detail);
  });
  document.addEventListener("cairl:error", function (e) {
    console.warn("verification error", e.detail);
  });
</script>

What your server receives

On the callback: validate state, exchange the code server-side at /api/oauth/token (with your client_secret and PKCE code_verifier), then read the boolean claims from /api/oauth/userinfo. The sub is a pseudonymous, per-partner identifier — no name, no document, no selfie. Full reference, error codes, and the sandbox-to-live path are in the quickstart.