Wiener Linien embedded doc-verify — sbx cross-site iframe test

This page is served from a FOREIGN origin (your tailnet), so embedding the SDK here is a real cross-site test, exactly like the WienMobil shop. Backend does the handshake server-side; creds never reach this page.

idle — make sure third-party cookies are BLOCKED in this browser, and DevTools>Network is open

PASS criteria (DevTools → Network, inside the iframe)

  1. regula-config 200, claim POST 200, /api/ping 200, /ws/device 101, docreader/drapi OK
  2. ZERO 401s on status/ping/ws/drapi. That is the fix being proven cross-site with 3rd-party cookies blocked.
  3. Reaching COMPLETE needs a real document+camera; the auth gate (no 401s + engine connects) is provable without finishing a scan.