OrderKit

White-label · Multi-tenant · Embeddable

Order forms that look like your brand, not ours.

Launch a fully branded, industry-specific service order form in minutes: live pricing, multi-tier taxes, deposits and an embeddable widget, built on a security-first architecture.

Try the live demoCreate your storefront

Try it live

Switch industries, then open the customizer to change the brand colours, logo, currency and taxes. The form below re-skins instantly.

order.apexautodetailing.com

Apex Auto Detailing

Showroom shine, wherever your car lives.

    Detail package(required)

    Pick the base level of service.

    Ceramic coating

    Optional long-term paint protection.

    Vehicle size(required)
    Add-ons
    • $60
    • $80
    • $70
    • $90
    • $350
    Where should we work?(required)
    Your details

    One engine, five industries

    Presets ship with pricing tiers, add-ons, sliders and fulfillment options for auto detailing, web agencies, home cleaning, photography and catering. Each tenant gets their own editable copy.

    • Dynamic calculations

      Itemized subtotal, percentage adjustments, multi-tier taxes, deposits and recurring retainers, computed in integer cents.

    • Embed anywhere

      Drop an iframe on any site. The widget auto-resizes and is restricted to the origins you approve.

    • Instant white-labeling

      Brand colours, corner radius and logo are applied through CSS variables, no rebuild required.

    Security architecture

    Defence in depth: each layer assumes the one before it can fail.

    • Validated everywhere

      Every input, query parameter, preset and payload passes a strict Zod schema on the client and again on the server. HTML is stripped from all text.

    • Sliding-window rate limits

      Order submissions, logo uploads and sign-ins are throttled per IP and per user with Upstash Redis (in-memory fallback for local dev).

    • Strict CSP, nonce-based

      A per-request nonce CSP, HSTS, nosniff, Referrer-Policy and Permissions-Policy. The embed widget is framed only by origins the tenant allows.

    • Hardened uploads

      2 MB cap, PNG/JPEG/SVG only, magic-byte sniffing, SVG script screening and randomized, sanitized filenames.

    • Row Level Security

      Tenants can only read and write their own storefront and orders. Anonymous visitors have no direct database access at all.

    • Server Actions + CSRF

      All mutations are Server Actions with origin verification. Prices are recomputed on the server so tampered totals are impossible.