HomeAdd a widgetany website
Add an online store to any website
Sell something from Any website without migrating the site onto an e-commerce platform. One widget is one purchasable thing, checkout runs on Stripe, and the money goes to your own Stripe account.
Free plan, no card. Paid plans start at $19 a month.
Why do it this way on any website
A static site with a Buy button is normally the moment you start looking for a backend. This is not that: the widget renders from a script tag, checkout runs on Stripe’s own hosted page, and the confirmation comes back to Sorraia. Your site stays a folder of files, and you still have orders, refunds and digital-download delivery.
See it working
This is a real Sorraia shop widget — our own sample product, embedded here exactly the way you would embed yours. Checkout is switched off on this one: click Buy and you will get “This shop is not ready to accept payments yet.” instead of a Stripe page. Everything up to that point is the live product.
How to add an online store to any website
The snippet Sorraia gives you is three lines: a comment, an empty placeholder <div>, and a <script> tag. The div is the anchor — the widget renders exactly where you put it and nowhere else.
In Sorraia, add the website and verify it — a DNS TXT record, or a meta tag in your homepage’s <head>. Verification is what lets you attach a widget to that site, so it comes before there is anything to paste.
Save the product and the Copy Embed Code popup appears; the Install wizard on the product’s row on the Shop page does the same with a verification step.
Copy the snippet from Sorraia. It already has your widget’s id and the right URL baked in, so copy it rather than retyping it.
Open the .html file (or the template, component, or partial) for that page and paste all three lines at the spot in the body where the widget should appear.
Save and deploy.
Load the live page. If nothing renders, open DevTools — the form, calendar and shop loaders log with a [WG] prefix — and check your Content-Security-Policy first.
What you get
Sell something from any website without migrating the site onto an e-commerce platform. One widget is one purchasable thing, checkout runs on Stripe, and the money goes to your own Stripe account.
Three ways to charge
A widget is a flat-price Buy Now, a pay-what-you-want donation where the customer sets the amount, or a recurring monthly or yearly subscription. You pick per widget, so a one-off product and a membership can live on the same site.
Three ways to fulfil
Digital emails a signed download link once Stripe confirms payment — the link is good for 24 hours. Physical collects a shipping address at checkout and applies one flat shipping rate, and you mark it shipped. Service skips fulfilment entirely and just tells you the sale happened.
Checkout is Stripe, and the account is yours
Payment runs as a direct charge on your own connected Stripe account, so payouts, disputes, receipts and tax settings stay in the Stripe dashboard you already use — we never hold your money in between. Sorraia takes a platform fee on top, deducted as a Stripe application fee: 2% on Free, falling to 1.5% on Starter, 1% on Growth, 0.5% on Business and 0.25% on Enterprise. Eight currencies are supported.
Orders and refunds in the dashboard
Orders land in Sorraia with the customer, the amount and the site they came from, filterable and exportable like every other list. Refunds are issued from the same place.
More detail in the Help Center: Shop basics · Embedding on your website
Things worth knowing about any website
- Astro bundles any <script src> that carries no other attribute — which is exactly the shape of the snippet. Add the is:inline directive so Astro leaves it alone.
- Hugo strips raw HTML out of Markdown unless markup.goldmark.renderer.unsafe is true. Put the tag in a layout or partial instead of in a content file.
- In React, dangerouslySetInnerHTML never executes a script — that is the HTML spec, not a React bug, and it fails silently. Render the placeholder <div> in JSX and load the script separately. In Next.js use next/script: lazyOnload in app/layout.tsx for a floating launcher, the default afterInteractive on the page itself for an inline widget.
- If your site sends a Content-Security-Policy, the directive that catches people out is style-src. The loader builds its stylesheet at runtime — createElement("style"), set textContent, append to <head> — which counts as an inline style, and it sets no nonce anywhere. So it needs 'unsafe-inline' there or the widget loads and renders completely unstyled. A nonce-only style-src breaks it, and 'strict-dynamic' does not help because that is a script-src feature. You also need the Sorraia API origin under connect-src and the host printed in your snippet under script-src.
- Because the widget renders into your DOM rather than an iframe, your own CSS reaches it — an aggressive global rule on form, input or button can restyle it, and an ancestor with overflow:hidden can clip it. That is the trade for having no sandbox: no isolation bugs, but no isolation either.
Questions
Do I need my own Stripe account?
Yes, and that is deliberate. Checkout is a direct charge on your connected Stripe account, so customers pay you and your payouts, disputes, receipts and tax configuration stay in the Stripe dashboard you already control — Sorraia never holds your revenue in between. Our platform fee rides along as a Stripe application fee, from 2% on Free down to 0.25% on Enterprise, so you can see exactly what it is on every charge.
Can I sell a subscription, or take donations?
Both. Each shop widget is set to one of three types — a flat-price one-off, a donation where the customer chooses the amount, or a recurring subscription billed monthly or yearly. Different products on the same site can use different types.
Do I need to install anything?
No. There is no plugin, no package and no build step — the whole install is one script tag. It works on a static site, a hand-written page, a Rails or Laravel template, an SSG like Hugo or Eleventy, or a React app, because it is plain HTML from the browser’s point of view.
Will it work behind a Content-Security-Policy?
Yes, with three directives. Allow the host printed in your own snippet under script-src, allow the Sorraia API origin under connect-src, and allow 'unsafe-inline' under style-src — the loader builds its stylesheet as an injected style element and sets no nonce, so a nonce-only style-src leaves the widget rendered but completely unstyled. If your widget uses a Google webfont, also allow fonts.googleapis.com under style-src and fonts.gstatic.com under font-src.
Add an online store to any website
Build it in Sorraia, paste one line into your site, and change it later without touching the embed again.