Live chat widget

Add the support chat to your website, sign in your own users with a JWT, control the chat from JavaScript and choose which sites may show it.

S System · Last updated Oct 9, 2026

The live chat widget is the chat button on your website: visitors write to you there, the AI assistant answers from your knowledge base, and your agents take over when needed. To add it, you paste one code snippet from the panel into the pages of your site.

Where the chat settings are

Your platform comes with a live chat inbox, so the chat is ready to install. Open Admin > Inboxes and click the inbox whose Channel is Live Chat. Its settings are grouped into tabs:

General: Name, Brand name, Website URL, Language and the Conversation continuity email inbox.
Appearance: Theme, Branding of the home screen and the Launcher, the round chat button.
Content: the texts of the chat in Messages, a Notice banner across the top of the chat, Home screen apps (the cards on the home screen), Help center and Proactive messages.
Conversations: Features (for example AI chat without agents and File upload), Office hours, Pre-chat form and the rules for Visitors and Users.
Setup: Installation (the code, Chat widget address and Designer address), Identity verification, JavaScript API and Security.
Designer: the look of the chat on your website and in your mobile app.

Next to the form, a preview shows your texts in the platform's standard chat window. An inbox with a Chat widget address (Setup > Installation), such as the inbox your platform came with, gives visitors our chat instead, so the place of the preview holds a note and an Open the Designer tab link: the chat as your site shows it is previewed on the Designer tab. Press Save at the bottom of the page to apply changes: visitors get them the next time a page with the chat loads.

Install the chat on your website

Open the live chat inbox, tab Setup, section Installation, and copy the code with the copy button.
Paste it just before the closing </body> tag on every page where the chat should appear. Most sites have one shared template or footer for this.

The code looks like this, with your support address and the ID of the inbox already filled in:

<script>
  window.SupportChatSettings = {
    baseURL: 'https://your-support-address',
    inboxID: 'YOUR_INBOX_ID'
  };
</script>
<script async src="https://your-support-address/widget.js"></script>

baseURL is the address of your platform, and inboxID identifies this live chat inbox. The cabinet shows the same code in the step Widget on the site, tab On a website. Enter the address of your site there and press I pasted it, please check: the cabinet opens the home page of that site and looks for the code.

If your support address changes, for example when you move to your own domain, copy the code again and replace the old one on your site. The old address keeps working, but the code on your site still points to it.

Install on a site builder

The code works anywhere on the page, at the end of <body> or in <head>: the chat starts once the page has loaded, also when the code itself arrives late. Paste it once into the setting that covers the whole site, not into a block on a single page, then check it in the cabinet with I pasted it, please check.

Site builder	Where to paste	Needs
WordPress on your own hosting	Install the free plugin WPCode - Insert Headers and Footers (Plugins > Add New Plugin), then Code Snippets > Header & Footer, paste into Footer, Save Changes	On WordPress.com, a paid plan for plugins
Shopify	Online Store > Edit theme, in the footer area Add section > Custom Liquid, paste, Save. Or Edit code, file `layout/theme.liquid`, before `</body>`	The Starter plan has no theme customization
Tilda	Site settings > Insert Code (More in older versions) > HTML code for the HEAD section, save, then Publish all pages	A paid plan, Personal or Business
Wix	Settings > Custom Code > + Add Custom Code, paste, All pages, Body - end, Apply	A Premium plan and a connected domain
Webflow	Site settings > Custom code > Footer code, Save changes, then Publish	A paid Site plan or a paid Workspace

Things that hide the chat:

A block on one page. Wix Embed HTML shuts the chat into a box on that page, and Tilda block T123 or the Webflow Code Embed element add it to one page only.
Delayed scripts. WP Rocket with Delay JavaScript execution runs the code only after the visitor scrolls or clicks: add widget.js to Excluded JavaScript Files. Other caching plugins need their cache cleared after you paste the code.
Cookie consent. In Wix, a Code Type category other than Essential makes the chat wait until the visitor accepts cookies.
Theme changes. A Shopify theme update or a switch to another theme does not carry the code over: paste it again. Shopify checkout pages show no chat.

Add another live chat inbox

A second inbox is useful when one chat must behave differently from another, for example a chat where only the AI answers next to a chat with agents (see AI chat without agents). Each inbox has its own code.

Go to Admin > Inboxes > New inbox and choose Live Chat.
On the General tab fill in Name, which your team sees in the panel, and Brand name, which visitors see at the top of the chat window. Website URL is optional: it is the page with the chat, used for links in continuity emails.
Press Create.

A new inbox gets the same chat as the inbox your platform came with. When Chat widget address and Designer address in Setup > Installation are both empty, as they are in a new inbox, the platform copies both from your earliest live chat inbox that has them when you press Create. The new inbox then has its own Designer tab, starting from the default look, and the microphone button where voice messages are available. If you want the platform's standard chat window for it instead, clear Chat widget address and Designer address after creating the inbox and press Save; the standard window has no Designer look and no microphone button. An address you type into either field yourself is kept as it is.

The assistant does not answer a channel added after your platform was set up until you add a rule for it: see Routing a new channel to the assistant.

Anonymous visitors

Without any sign-in, every visitor is anonymous. The chat remembers an anonymous visitor in the same browser with cookies on your site's domain, so they see their conversations on every page of your site and when they come back later. On another device or in another browser the same person is a new visitor. To recognize people everywhere, sign them in with a JWT as described below.

If people have accounts on your site, they can enter the chat as themselves. Their conversations are then linked to their account in your system, they see their history on any device, and nobody can pose as someone else. The inbox shows the steps under Setup > Identity verification.

How it works:

Your server builds a JWT with the user's details and signs it with the inbox Secret key, algorithm HS256.
Your page hands the token to the chat in userJWT or with SupportChat.setUser().
The platform checks the signature and finds the contact by external_user_id, creating it the first time.

Fields of the JWT

Field	Required	Meaning
`external_user_id`	yes	The user's ID in your system, up to 128 characters. The same ID means the same person next time.
`exp`	yes	When the token expires, as Unix time in seconds.
`email`	no	Add it only if your system has confirmed the address. A first sign-in is then linked to an existing contact with this email that has no ID from your system yet, together with that contact's history.
`first_name`, `last_name`	no	Up to 128 characters each.
`phone_number`	no	Up to 20 characters.
`phone_number_country_code`	no	Two-letter country code of the phone number, for example `EE` or `DE`.
`contact_custom_attributes`	no	An object with your own fields, saved to the contact's attributes at every sign-in.

Only external_user_id and exp are required, so a site or an app can sign people in with a phone number alone. A contact without a name appears to agents under the phone number, or under the ID when there is no phone. An empty field in a token never erases data saved earlier, and a changed name, email or phone updates the contact.

Sign the token on your server

Create the token on your server, when you render the page or in an endpoint that only a signed-in user can call. A short lifetime such as 10 minutes is enough: the chat exchanges the token for its own session right away. The secret key must never reach the browser or a mobile app.

Python with PyJWT, sign-in by phone:

import time
import jwt  # PyJWT

token = jwt.encode(
    {
        "external_user_id": str(user.id),
        "phone_number": user.phone,
        "exp": int(time.time()) + 600,
    },
    INBOX_SECRET,  # the Secret key of the live chat inbox, stored on the server
    algorithm="HS256",
)

Node.js with jsonwebtoken, sign-in with a confirmed email:

const { sign } = require('jsonwebtoken');

// user is the signed-in user of your site
const token = sign(
  {
    external_user_id: String(user.id),
    email: user.confirmedEmail,
    first_name: user.firstName,
    exp: Math.floor(Date.now() / 1000) + 600
  },
  process.env.INBOX_SECRET,
  { algorithm: 'HS256' }
);

Any library that signs HS256 tokens works the same way.

Pass the token to the chat

Add userJWT to the settings in your snippet:

<script>
  window.SupportChatSettings = {
    baseURL: 'https://your-support-address',
    inboxID: 'YOUR_INBOX_ID',
    userJWT: 'TOKEN_FROM_YOUR_SERVER'
  };
</script>
<script async src="https://your-support-address/widget.js"></script>

If a user signs in after the page has loaded, call window.SupportChat.setUser(token). When they sign out of your site, call window.SupportChat.logout(): the chat forgets their session, and the next person in that browser starts as a new anonymous visitor.

The secret key

The key is in the inbox, tab Setup, section Security, field Secret key:

the eye icon shows the key, and the copy button copies it for your backend;
Generate creates a new random key of 48 characters, and Save stores it;
a key shorter than 32 characters gets a warning, because a short key makes the signature weak.

After you change the key, put the new one on your backend as well: tokens signed with the old key are no longer accepted. Only staff with the Manage inboxes permission can open these settings and see the key.

What signing in changes

Conversations that a person had as an anonymous visitor in the same browser move into their account when they sign in.
The contact's name, email and phone follow the token when they change.
A signed-in user counts as verified. Custom tools marked Require verified contact run for them without the one-time email code, so the assistant can answer personal questions such as the status of an order. The tool request carries the headers X-Support-Contact-External-Id and X-Support-Contact-Verified: true, which the model can neither see nor change. See Custom tools.

How long a signed-in session lasts

Authenticated user session duration on Setup > Security sets how long the chat keeps a signed-in user's session. Every use of the chat extends it. The minimum is one hour, for example 24h, 168h (a week) or 720h (30 days). Every inbox starts with 4320h (180 days), the inbox your platform came with and an inbox you create alike. When the session runs out, your page has to give the chat a freshly signed token.

Control the chat from JavaScript

Once the code has loaded, the page has a window.SupportChat object. The inbox lists the main calls under Setup > JavaScript API.

Call	What it does
`SupportChat.show()`	Opens the chat window.
`SupportChat.hide()`	Closes the chat window.
`SupportChat.toggle()`	Opens the window if it is closed and closes it if it is open.
`SupportChat.isVisible()`	Returns `true` while the window is open.
`SupportChat.setUser(token)`	Signs a user in after the page has loaded.
`SupportChat.logout()`	Signs the user out; the chat starts over with an anonymous visitor.
`SupportChat.onShow(fn)`	Calls `fn` each time the window opens.
`SupportChat.onHide(fn)`	Calls `fn` each time the window closes.
`SupportChat.onUnreadCountChange(fn)`	Calls `fn` with the number of unread replies: once right away, then each time the chat reports a new number.
`SupportChat.trackEvent(name)`	Reports an event of your page, up to 128 characters, for proactive messages with an Optional event name (see "Proactive messages" below).

A reply counts as unread while the visitor does not see it: the chat window is closed, the browser tab is hidden, the home screen or the list of conversations is open, or another conversation is on screen. The number changes as soon as such a reply arrives, and a conversation the visitor opens counts as read.

Example: your own Help button with an unread counter instead of the round chat button. Here the chat starts from window.initSupportChat() once the script has loaded, so the callbacks are registered on a ready object:

<button type="button" id="help-button">Help <span id="help-unread"></span></button>

<script>
  function startSupportChat() {
    var chat = window.initSupportChat({
      baseURL: 'https://your-support-address',
      inboxID: 'YOUR_INBOX_ID',
      hideLauncher: true
    });
    document.getElementById('help-button').addEventListener('click', function () {
      chat.toggle();
    });
    chat.onUnreadCountChange(function (count) {
      document.getElementById('help-unread').textContent = count > 0 ? '(' + count + ')' : '';
    });
  }
</script>
<script async src="https://your-support-address/widget.js" onload="startSupportChat()"></script>

Settings in SupportChatSettings

Setting	Meaning
`baseURL`	Your support address. Required.
`inboxID`	The ID of the live chat inbox. Required.
`userJWT`	The signed token of a signed-in user.
`locale`	The language of the chat, for example `'uk'` or `'de-DE'`, when your site shows a language other than the visitor's browser.
`hideLauncher`	`true` hides the round chat button, so the chat opens only from your code.
`cookieDomain`	The domain for the chat cookies, for example `'.example.com'`. Without it the chat uses the main domain of your site, so the visitor is recognized on all its subdomains.

Language of the chat

Language on the General tab decides the language of the chat's buttons and hints:

Auto-detect (browser language) follows the visitor: the chat takes the locale your page passes in SupportChatSettings, otherwise the browser language. When the chat has no translation for it, the Fallback language is used.
A fixed language applies to everyone, whatever the browser or locale say.

The chat's own buttons and hints exist in English, Estonian, Russian, Ukrainian, German, French, Spanish, Italian and Brazilian Portuguese, among others. When the language is not among the translated ones and the Fallback language is not either, they appear in English. Your own texts can be in any language (next section), and the assistant answers in the visitor's language as described in Assistant settings.

Texts in several languages

A text the visitor sees can be the same for everyone or written per language. This works for Greeting message, Introduction message and First message in Content > Messages, and for Start conversation button text in Conversations > Users. Write one line per language with the language code and a colon, and a default line for every other language:

de: Hallo! Wie können wir helfen?
et: Tere! Kuidas saame aidata?
default: Hello! How can we help?

Every line needs a code of two letters, optionally with a region such as de-DE: if one line has none, the whole field counts as a single text for everyone. The line is picked by the exact code first, then by the main language (en also serves en-GB), then default. Which language counts depends on the text:

Greeting message, Introduction message and the button text follow the language of the chat's buttons from the previous section. On the home screen visitors therefore see the line in the chat's own language (English, Estonian, Russian, Ukrainian, German and so on) or default.
First message is picked for each conversation: the language the assistant answers in when the field has a line for it, otherwise the browser language.

The preview next to the form shows the text in the language of your panel.

The visitor's name in the greeting

Greeting message and Introduction message can address the visitor by name: write {{.FirstName}} or {{.LastName}}, and add a fallback word after a vertical bar for people whose name is unknown, for example Hello, {{.FirstName | there}}!. The name comes from what the chat knows about the person, such as the token of a signed-in user. Without a name and without a fallback word the placeholder disappears. A placeholder without the dot, such as {{FirstName}}, is shown as typed.

The first message and the AI notice

When a visitor starts a conversation in an inbox that a rule hands to the assistant, the assistant posts a first message into it: your First message text followed by a short notice that the visitor is talking to an AI assistant. An inbox where your agents answer gets no first message. The notice is added automatically and cannot be removed, because the EU AI Act requires it. It comes in the language of the first message when the platform has a translation for it. In a normal chat it also says that the visitor can ask for a human at any time; in an AI chat without agents it only says that an AI assistant answers.

Our chat shows this first message as soon as the visitor opens an empty chat, so the window greets them before they type anything. When they send their first message, the same text is posted into the conversation in its place; it can switch language if the visitor writes in another one. If the visitor only says hello, the assistant does not greet them a second time.

The first message stays in the conversation history, visible to the visitor and to your agents. Greeting message and Introduction message work differently: they are shown on the chat's home screen and are not posted into the conversation.

Rules for visitors and signed-in users

Conversations > Users has two tabs: Visitors for people who are not signed in and Users for people signed in with a JWT. The chat follows the tab that fits the person and switches when someone signs in or out. Each tab has:

Start conversation button text: the button on the home screen.
Quick replies: up to 6 ready answers, one per line. Before the first message of a new conversation they appear as buttons above the message field, and a press sends that text.
Launch directly into conversation: the chat opens straight into the conversation instead of the home screen.
Allow start conversation: when it is off, the home screen has no start button and the chat says that starting a new conversation is not available. Conversations that already exist stay open for replies.
Prevent multiple conversations: one conversation per person in this inbox, closed ones included, so the New conversation button disappears once there is one.
Prevent replying to closed conversations: a conversation with the status Closed shows that it is closed instead of the message field. Without this switch the visitor can still write there, and the message reopens the conversation.

Inside the conversation

Chat introduction (Content > Messages) is a short line at the top of the conversation.
While the AI assistant handles a conversation, the line under the chat header shows the assistant's Expectation message, if it has one, in place of the office hours. It disappears when a person takes over. See Assistant settings.
When the assistant asks a question with obvious short answers, or asks whether its answer helped, the options appear as buttons under its message until the visitor writes, and a press sends that option.
With Download transcript on (Conversations > Features), the chat header has a button that saves the open conversation as a text file, without private notes.
On a computer, a button in the chat header makes the window wider, up to Expanded width from the Designer tab, and back. Going back to the home screen returns the window to its normal width.

The pre-chat form

Conversations > Pre-chat form asks for the visitor's details before the first message. Turn on Enable pre-chat form, then on the Visitors and Users tabs switch on Show form to this audience, enter a Form title and set up the Form fields: each field has a label, a placeholder and Required, and more fields come from Available custom attributes. The chat shows the form only to someone it does not know yet: a returning visitor or a signed-in user writes straight away.

Each field is asked in its own way: a list as a choice of its values, a checkbox as a tick box (left unticked, it counts as no), a date, a number or a link in a field of that kind, and a phone number with a country selector next to it. The country is preset from the visitor's language settings, and a number typed with its country code, such as +372, picks that country by itself. Agents see the answers on the contact and in the conversation.

With Show only during AI handoff on, the form is not shown when a chat starts. The assistant asks for it when it is about to pass the conversation to a person, see Handoff to agents and back.

Help articles on the home screen

The home screen can show articles of one of your help centers (see Help center):

On the Content tab, under Help center, choose the help center. Under Featured articles pick up to 10 articles, or leave the list empty to show the most popular ones.
Under Home screen apps, press Add help articles. The button works once a help center is chosen.
Press Save.

The card has a search field with up to five articles under it. Typing two or more characters searches the help center and lists what it finds. An article opens in a new browser tab on the public page of your help center. The card uses the visitor's language when the help center has it and the help center's default language otherwise, and it is not shown when there are no articles to list. It appears in the website chat and in the mobile app chat, but not with the AI chat widget type, which has no home screen.

Proactive messages

A proactive message pops up next to the chat button while a visitor browses your site, for example "Need help choosing a plan?". Add one on the Content tab under Proactive messages with Add proactive message:

Name for your own list, Message, Sender and Route replies to team;
Who sees it: Audience, Devices and Visible when conditions on contact attributes;
Where and when: Include pages and Exclude pages (one address or path per line, * matches anything), Active time on page (seconds), Optional event name and Business hours rule;
Repeat: Show again once per person, once per session or after Repeat after (hours).

Messages are checked from top to bottom, and the first that matches is shown. Minimum time between proactive messages (24h unless you change it) spaces them out for one browser. An inbox holds up to 50 proactive messages, and Proactive message results shows how they did.

The message appears only on your website, not in the mobile app, and only while the chat window is closed, the visitor has no unread replies and the chat button is visible. The visitor can close it or click it. A click opens the chat with your message first, from its sender, and a conversation is created only when the visitor replies, in text. For a message with an event name, your page reports the event with window.SupportChat.trackEvent('pricing_viewed'), using the same name; the event is forgotten when the page address changes.

New replies next to the chat button

While the chat window on your website is closed, the latest unread replies, up to three, appear as cards next to the chat button with the author and the start of the text. A click opens that conversation, and Hide and Hide all remove the cards.

Theme, colors and the chat button

The Appearance tab fits the chat to your site:

Theme: Match system follows the visitor's light or dark mode, Light and Dark fix one of them. The dark theme darkens the chat window only while Background and Text color on the Designer tab keep their defaults.
Branding: Logo URL, shown at the top of the home screen above the greeting, and Primary color, which the chat window uses while the Designer tab leaves the primary color to this section. Part Home screen: Header text color, Background (Solid, Gradient or Image) and Fade background of the home screen. All of them are set separately for the light and the dark theme.
Launcher: Launcher logo and Launcher color of the round chat button, also per theme, its Position (Left or Right), Icon size (how much of the button the logo fills, in percent), and Side spacing and Bottom spacing in pixels.

The other colors of the chat window, its size and the size of the button are set on the Designer tab. On a computer the chat opens as a window next to the button; on screens up to 600 pixels wide, such as phones, it opens full screen.

The Designer tab

The Designer tab changes the look of the chat without code and shows a live preview next to the settings. It has two tabs: Website for the chat on your site and App for the chat in your mobile app (see Mobile app chat). The tab is shown when Designer address in Setup > Installation is filled; for the live chat inbox your platform came with and for live chat inboxes you add later this is done for you.

Settings for the website:

Widget type: Default shows the home screen and the list of conversations as set in the inbox. AI chat opens straight into the conversation, without the home screen and the list, and the New conversation button at the top starts over. The type changes only the layout: whether agents answer is set by AI chat without agents in Conversations > Features.
Colors and shape: Primary color, Background, Text color, Bubble corners, Density (Compact or Comfortable) and Font, where empty means the system font. While From the Branding section of this inbox under Primary color is ticked, the chat takes the primary color from Branding on the Appearance tab, its own for the light and the dark theme; untick it to choose a color here.
Chat window: Width from 280 to 720 pixels (400 by default), Height from 360 to 900 (700), Expanded width from 400 to 1200 (750), which the window takes when a visitor widens it, and Window corners from 0 to 32 (16).
Button on the site: Button size from 40 to 88 pixels (60). On phones the button keeps its standard size.
Behavior: Voice messages (the microphone button), Open the chat right away, which opens the chat as soon as a page loads, and Show that the agent is typing, which decides whether visitors see that a reply is being typed.

Website changes are stored by the Save button of the settings page, like every other setting.

Settings the current chat does not use

One setting of the inbox form has no effect on the chat on your site at the moment: Show Help tab under Help center on the Content tab. Help articles appear in the chat as the card on the home screen, see "Help articles on the home screen" above.

The Powered by EPAV Desk line

At the bottom of an open conversation the chat shows "Powered by EPAV Desk" with a link to epavdesk.com. The line is the same in every language. To hide it, turn off Show powered by on Appearance, section Theme, and press Save. It can be hidden but not replaced with other text.

Files, emoji and voice

On Conversations > Features:

File upload lets visitors attach files. The attach button appears once the conversation has started, because a file goes into an existing conversation. The size limit and the allowed types apply to the whole platform and are set in Admin > General: Max allowed file upload size (20 MB unless you change it) and Allowed file upload extensions (* allows every type).
Emoji support adds the emoji button.

When speech recognition is set up and File upload is on, the chat also shows a microphone button next to the message field: see Voice messages.

Continue the conversation by email

A visitor may close the page before an answer arrives. The platform can then email them the replies they have not read, and their answer to that email comes back into the same chat conversation.

Connect an email inbox first: see Email.
In the live chat inbox, tab General, choose that inbox in Conversation continuity email inbox.
Set the three fields that appear: - Offline threshold: how long after the visitor left the chat the email goes out. Default 10m, at least 1m. - Max messages per email: how many unread replies one email carries, from 1 to 100, default 10. The rest follows in the next email. - Min email interval: the shortest gap between two such emails for one conversation. Default 15m, at least 1m.
Fill Website URL on the same tab: the email then links back to the chat.
Press Save.

This works only when the visitor's email is known, for example from the pre-chat form or from the token of a signed-in user. The reply address of these emails carries a plus tag, like support+conv-...@yourcompany.com, so your mailbox has to accept plus addresses; Gmail and Microsoft 365 do.

Which websites may show the chat

Domain list on Setup > Security limits where your chat works. Write one domain per line:

example.com
*.example.com
shop.example.org

*.example.com covers subdomains only, so list example.com separately. With an empty list any site can show the chat window. Fill the list to stop other sites from embedding your chat.

A filled list controls three things: which sites may show the chat window, which other sites may call the chat's API from a browser, and which may open its live connection. The chat on your own website needs only the first, because its window is served from your support address. The other two matter for the chat page of a mobile app, which has an address of its own: that domain has to be on the list, so with a mobile app the list cannot stay empty. See Mobile app chat.

Block IP addresses

IP block list on Setup > Security shuts specific visitors out. Write one IP address or range per line, IPv4 or IPv6, for example 203.0.113.7, 198.51.100.0/24 or 2001:db8::/32. From a blocked address the chat does not load and cannot connect.

Cookies the chat sets on your site

The chat code keeps what it needs in cookies on your site's domain, so it recognizes the visitor on every page:

Cookie	Purpose	Lifetime
`support-session-<inbox ID>`	the chat session of the visitor or signed-in user	1 year
`support-visitor-<inbox ID>`	the anonymous visitor, so that their history can move into their account after sign-in	1 year
`support-campaign-<inbox ID>`	a random ID of the browser	1 year
`support-campaign-session-<inbox ID>`	a random ID of the current visit	until the browser closes

The cookies use SameSite=Lax, and Secure on HTTPS sites. logout() deletes the first two. The cookieDomain setting changes their domain.

What agents see about the visitor

Signed-in users appear to agents with the name, email or phone from their token. The conversation sidebar also has a Last visited pages list: the latest pages of your site with the chat on them that the visitor opened. While the visitor is typing a message, agents see that in the conversation.

Our chat and the mobile app package use a public HTTP API and a WebSocket on your support address. You can use them for a chat interface of your own:

Every request names the inbox in the X-Support-Inbox-ID header or the inbox_id query parameter. Requests on behalf of a visitor carry Authorization: Bearer <session token>.
Settings: GET /api/v1/widget/chat/settings/launcher and GET /api/v1/widget/chat/settings.
Sign-in: POST /api/v1/widget/chat/auth/exchange turns a signed JWT with the fields above into a session token, and GET /api/v1/widget/chat/auth/me tells whom a token belongs to.
Conversations: POST /api/v1/widget/chat/conversations/init starts one; without a token it creates an anonymous visitor and returns a session token, and a voice recording can start a conversation too. GET /api/v1/widget/chat/conversations lists the conversations, GET /api/v1/widget/chat/conversations/{uuid} returns one with its messages, POST /api/v1/widget/chat/conversations/{uuid}/message sends a message, and after POST /api/v1/widget/chat/conversations/{uuid}/update-last-seen the platform counts the conversation as read by the visitor.
Files: POST /api/v1/widget/media/upload, a multipart form with conversation_uuid and one file in files. The limits of File upload and Admin > General apply.
Live events: a WebSocket at /widget/ws. After connecting, send a join frame with the inbox ID and the session token, then a ping frame about every 10 seconds to keep the connection open. A page_visit frame with the address and title of a page adds it to Last visited pages for agents.
When a signed-in user takes over from an anonymous visitor, send the old visitor token in X-Support-Visitor-Token. After the merge the response carries X-Support-Clear-Visitor: true, and the old token can be discarded.
Answers come in an envelope with the payload in data. Requests are rate limited per IP address: on status 429, wait and try again.
A browser page on another domain can call the API only if that domain is in the Domain list of the inbox.