Developer docs

Bookmarklet

The bookmarklet is a bookmark that loads the DeploySeal widget on the page you are looking at. It is for the pages nobody can add a script to, such as a store's admin area, a hosted payment page or a third-party tool, when testers still need to pin issues there. Clicked, it adds the same widget tag the snippet would, stamped with data-ds-installer so the site page knows where the widget came from, and nothing else.

<script
  src="https://cdn.deployseal.com/ds-widget.js"
  data-ds-site-key="ls_••••••••••••••••••••••••••••••••••••"
  data-ds-environment="staging"
  data-ds-installer="bookmarklet/1.0.0"
  async
></script>

Set it up

1. In DeploySeal open Sites → your site, expand the environment under Environments and find Bookmarklet. Each environment has its own, named DeploySeal · your site · the environment.
2. Drag the link to your browser's bookmarks bar. If dragging is awkward, press Copy and paste the copied text as the address of a new bookmark.
3. Make sure the pages you want to test are on the environment's allowed origins. An admin area on its own host is a separate origin and has to be registered too.
4. Open the page and click the bookmark. For a tester with an active invitation the widget appears as it does with the snippet; for anyone else nothing visible happens.

Share the bookmark with testers the same way: send them the copied text, or ask them to drag it from the site page if they have access to it. It carries the environment's public key, which is not a secret — it only works from the environment's allowed origins.

Snippet, plugin or bookmarklet

The snippet and the plugins are permanent installs: the widget is on every page, every page load sends a heartbeat, and the build marker tells the readiness report which code was tested. The bookmarklet supplements them for the pages they cannot reach. Use it on its own only when no page of the environment can carry a script.

What it cannot do

• No build marker. A bookmark cannot know which build is running, so issues pinned through it carry none unless the page itself exposes <meta name="ds-build">. The report then shows the build as unverified for that evidence.
• Pages with a strict security policy. When a page's Content-Security-Policy does not allow our CDN, the browser blocks the script and the bookmarklet says so in a small notice. A bookmark cannot widen a page's policy.
• One page at a time. The widget stays for as long as you are on that page. After a full page load, click the bookmark again.
• Only on registered origins. Origin matching is exact, so the widget answers only where the environment says it may, the same rule as every other install path.

When the widget is already on the page

If the page already carries the widget, from the snippet or a plugin, the bookmarklet adds nothing and shows DeploySeal is already installed on this page. for a few seconds. So it never puts a second tag on a page, and the site page does not warn about two install paths when it sees both a permanent install and the bookmarklet on the same environment. The environment card shows the bookmarklet as the last install path seen whenever a tester used it most recently.

Privacy

• It runs only when the person holding the bookmark clicks it, only on the page they click it on, and only until they leave that page. Nobody else who visits the page is affected.
• It activates only on the environment's registered origins. Clicked anywhere else, the DeploySeal API refuses the page and nothing is recorded.
• Once loaded it is the ordinary widget: it records only while an invited tester has an active session, and it honours the same masking rules (data-ds-mask, .ds-mask) described in the widget reference.

Troubleshooting