Templates and fields
Templates contain HTML, CSS, a page size, sample values, and a field schema. Rendering runs without external network access.
Built-in placeholders
Common fields include name, course, date, and score. CertKit injects cert_id and the QR code; callers cannot override them.
Custom fields
Define a lowercase field key, label, type, and required state. API and CSV values are plain strings with a 500-character limit. Unknown, missing, or oversized fields fail validation before a certificate is issued.
Safe assets
Use uploaded workspace assets. Remote images, scripts, frames, and external CSS are rejected so rendering remains deterministic and isolated.
Publishing
Preview before publishing. Publishing creates an immutable version. Later edits create another version and never alter already-issued certificates.