Embed the widget

The website widget is a single <script> tag. It loads from the widget Worker domain and renders a launcher plus an iframe panel.

Minimal embed#

Add this before the closing </body> tag, replacing CHANNEL_UUID with your widget channel's UUID (from Settings → Channels → Website widget):

<script
  type="module"
  src="https://widget.chatasist.com/embed.js"
  data-chatasist="CHANNEL_UUID"
  data-chatasist-lang="en"
></script>

Configuration attributes#

All options are set as data- attributes on the script tag:

Authenticating a known customer#

For anonymous visitors no extra setup is needed. To bind the session to a customer you already know, supply a session JWT:

• Short-lived: POST /api/v1/widget/session-jwt
• Long-lived (cwt_): POST /api/v1/customers/{id}/widget-embed-token

Pass the result as data-chatasist-session-jwt="…", or set window.__CHATASIST = { widgetId, baseUrl, sessionJwt } before embed.js loads. If the JWT only becomes available after login, set the attribute then — the embed watches the script tag and rebinds automatically without a page reload. You can also call window.ChatasistWidget.setSessionJwt('cwt_…').

Passing a customer token to your MCP server#

If you connect your own data through an MCP server, you can have the AI agent's live lookups carry a token your backend understands — so your server authenticates the customer itself instead of trusting an identifier alone.

Issue that token however your app already does (a signed JWT, a session token — whatever your MCP server validates) and pass it as:

<script
  src="https://widget.chatasist.com/embed.js"
  data-chatasist="YOUR_CHANNEL_UUID"
  data-chatasist-customer-token="the-token-your-backend-issued"
></script>

or window.__CHATASIST = { widgetId, customerToken: '…' } before embed.js loads.

The widget sends it to Chatasist as the X-Customer-Token header, and Chatasist forwards it unchanged to your MCP server under the same header on every tools/call for that customer — alongside the server's own credential, not in place of it. Your server reads X-Customer-Token, validates it, and scopes the lookup to that customer.

The visitor's country#

Chatasist also forwards where the visitor is browsing from, as Cloudflare resolved it on the widget request, under the X-User-Country header — a two-letter ISO code such as AZ. Nothing is needed on your side to send it.

Use it to answer for the right region: price in the local currency, hide what you cannot ship there, or pick a warehouse. The header is simply absent when the country could not be resolved (Cloudflare's XX) or the visitor came through Tor (T1), so treat a missing header as "unknown", never as a default country.

Refreshing the token before it expires#

Customer tokens are usually short-lived. When yours is about to expire, mint a fresh one and hand it to the widget — no reload, and the open conversation is untouched:

window.ChatasistWidget.setCustomerToken('the-freshly-minted-token');

Every request the widget makes after that carries the new token. Pass null to clear it.

If a token does expire first, nothing breaks: your MCP server answers 401, Chatasist repeats the lookup without the token, and the customer is asked to confirm by code instead. Refreshing on time simply spares them that step.