Skip to content
Auteryn

Widget Gateway

The widget gateway powers the embedded web widget. Authentication uses widget API keys (wk_pub_ / wk_sec_), then optional JWT for message calls.

Base URL: https://agent-api.auteryn.ai

Authentication flow

Section titled “Authentication flow”
  1. POST /api/v1/widget/init — validate domain + API key; returns session_id and widget config
  2. POST /api/v1/widget/auth?session_id=... — optional JWT exchange for the session
  3. POST /api/v1/widget/message — send chat messages (SSE response); auth via Bearer JWT or X-API-Key
  4. GET /api/v1/widget/history/{session_id} — fetch conversation history

The agent is bound to the widget connection via a Flow — not passed in the embed script.

Widget API keys

Section titled “Widget API keys”

Widget keys are separate from org API keys:

Type Prefix Usage
Public wk_pub_... Client-side embed (domain-restricted)
Secret wk_sec_... Server-side only

Create a widget connection in Console → Integrations → Web Chat Widget.

Example: init

Section titled “Example: init”
POST https://agent-api.auteryn.ai/api/v1/widget/init
X-API-Key: wk_pub_xxxxxxxx
Origin: https://yoursite.com
Content-Type: application/json
{
  "fingerprint": "browser-fingerprint-string",
  "visitor_id": "optional-persistent-visitor-id",
  "referring_page": "https://yoursite.com/pricing"
}

Response includes session_id — required for /auth and /message.

Example: auth

Section titled “Example: auth”
POST https://agent-api.auteryn.ai/api/v1/widget/auth?session_id=sess_abc
X-API-Key: wk_pub_xxxxxxxx
Origin: https://yoursite.com

Returns { "access_token": "...", "expires_in": 3600 } when JWT exchange succeeds.

Example: send message

Section titled “Example: send message”
POST https://agent-api.auteryn.ai/api/v1/widget/message
Authorization: Bearer eyJ...
Content-Type: application/json
Origin: https://yoursite.com
{
  "content": "How do I reset my password?",
  "session_id": "sess_abc"
}

Alternatively, pass X-API-Key: wk_pub_... instead of Bearer JWT.

Domain restriction

Section titled “Domain restriction”

Widget keys are restricted to allowed domains configured on the connection. Requests from other origins are rejected.

Section titled “Related”