Skip to content
Auteryn

Website channel

The Website channel puts a chat on your site that your customer-facing agent answers. Visitors don’t need an account. You add a website in the Console, choose the agent, and paste one script tag before </body>.

Each website has its own page in the Console, with the install snippet and every setting described below.

Set up a website

Section titled “Set up a website”

Only owners and admins can add a website.

  1. In the Console, open Integrations, find Web Chat Widget and click Connect (or Connect another account if you already have one).
  2. In Add a website, enter a name your team will recognize and the domains the chat may load on, one per line. Click Create website.
  3. The website’s page opens with your identity secret. Copy it and store it on your server now: you won’t see it again. You need it only to identify signed-in visitors.
  4. Under Agent, choose the customer-facing agent that answers visitors.
  5. Under Install, copy the snippet and paste it before </body> on every page that should show the chat.

Until an agent is chosen and a domain is allowed, the Install section says what is missing.

Install

Section titled “Install”

The Install section prints your website’s snippet, pinned to the widget’s current version. The script-tag form carries the version’s integrity hash; the browser refuses the script if it does not match, so copy the snippet rather than typing it. It comes in four forms:

<script async src="https://cdn.auteryn.ai/widget/2.1.2/loader.js"
  integrity="sha384-…"
  crossorigin="anonymous"
  data-site="site_pub_…"></script>

site_pub_… is your website’s public key. It is meant to sit in your page source: the chat loads only on the domains you allow.

The conversation runs in a frame on widget.auteryn.ai, so scripts on your page can’t read it. If your site sends a Content Security Policy, allow https://cdn.auteryn.ai in script-src and https://widget.auteryn.ai in frame-src.

The website’s page

Section titled “The website’s page”

Open it from Integrations (Edit settings on the website’s connection) or from the agent’s Channels list. Members of your organization see it read-only; only owners and admins can change a website.

On a wide screen the page shows a preview beside the form, drawn from your unsaved changes. Replies in the preview are placeholders. Click Save changes in the bar at the bottom; visitors see the changes the next time they open the chat.

Agent

Section titled “Agent”

One agent answers on a website, and it must be customer-facing. To move the website to another agent, choose it here; the page asks before it moves. The website’s numbers start again after a move.

Allowed domains

Section titled “Allowed domains”

Enter one domain per line (up to 32). The chat loads nowhere else.

  • example.com is that domain only. Add a port if your site uses one: example.com:8443.
  • *.example.com covers its subdomains but not example.com itself, so list both if you need both.
  • Use http://localhost:3000 to test on your machine. Every other domain uses https.
  • A path, or a wildcard over a shared domain such as *.co.uk, is refused, and the page shows which entries it refused.

When the list is applied, the section reads Live on these domains. Until then the chat is blocked on every page.

Abilities

Section titled “Abilities”

A website is read-only by default. The agent answers and looks things up, but can’t use abilities that change data.

To allow one, tick it under Abilities. It lists the agent’s abilities that change data and are allowed on a website:

  • create a calendar event (Google Calendar)
  • create an issue (GitHub or Jira)

Deleting and other sensitive actions are never offered, and any ability you leave unticked is off on this website, whatever the agent can do elsewhere.

Before an allowed ability runs, the visitor sees what it will do, such as an email’s subject and recipient, and chooses Confirm or Cancel. The agent is told when the visitor cancels. A confirmation left unanswered for an hour counts as a cancel. If the agent later loses an ability you ticked, the page says so.

Daily credit cap

Section titled “Daily credit cap”

Cap this website’s credits per day limits what the website can spend. New websites start at 100 credits a day. The cap resets at 00:00 UTC. Without a cap, the website can use any of your organization’s credits.

When the website reaches its cap, the chat doesn’t start new replies until the reset. A reply already running finishes, so a day’s total can pass the cap by that reply’s cost.

Identity secret

Section titled “Identity secret”

The page shows the secret once: after you add the website, and after each rotation. Store it on your server, in a variable such as AUTERYN_IDENTITY_SECRET, and never in browser code. Rotate secret issues a new one; the previous secret keeps working for 24 hours while you deploy the new one. See Identify signed-in visitors.

Appearance

Section titled “Appearance”
Setting Choices
Name in the chat The name visitors see
Avatar An https:// image address, or empty for the default
Brand color Any color; text on it is chosen for contrast
Theme Auto, Light or Dark
Corners Sharp, Soft or Round
Launcher Circle, Pill (with your launcher text), or None to open the chat from your own button with Auteryn('open')
Position Bottom right or bottom left

Every chat shows “Powered by Auteryn”.

Content

Section titled “Content”
Setting What it does
Greeting The first line visitors read
Starter prompts Up to 6, shown before the first message, 80 characters each
Nudges Up to 10 short messages beside the launcher, on pages matching a path such as /pricing or /docs/*, after a delay or a scroll depth you set
Ask for contact details Off; During the chat (the agent asks when it needs them); or Before the chat (visitors enter an email, and a name if they like, before the first message)
Features Feedback (visitors rate answers up or down), File uploads, Dictation (visitors speak a message, in browsers that support it), and Hand-off to a person (visitors can ask for a person, and the agent can hand the chat to your team; see Hand a conversation to a person). File uploads and Hand-off to a person start off; the other two start on
Image hosts Up to 10 hosts, like images.example.com or *.example.com, whose images show in the chat. Images from other hosts don’t

A visitor you have identified is not asked for contact details before the chat.

Steps visitors see

Section titled “Steps visitors see”

While the agent works, visitors see a line for each step: searching your Knowledge, reading from each Integration the agent uses, and each ability you allowed. Label a step in your own words, or hide it. A step with no name shows “Working on it”.

Numbers

Section titled “Numbers”

The last 30 days on this website:

  • Conversations
  • Helpful answers: the share of rated answers that visitors rated up. It reads “No rated answers yet” until one is rated.
  • Top questions: the 5 most common opening questions.
  • Answered without a person: the share of conversations that did not need one, with a line counting them. It shows once hand-off is on.

What visitors can do

Section titled “What visitors can do”
  • Ask questions and read the answer as it arrives. When the agent used your Knowledge, the answer can list its sources; a source links out only when it is a public web page.
  • Stop a reply, and rate answers when Feedback is on.
  • Attach files when File uploads is on: PNG, JPEG, WebP, GIF, PDF, and text or CSV, up to 10 MB each.
  • Confirm or cancel an ability you allowed, before it runs.
  • Answer the agent’s questions in the chat with a choice, a short form, a time slot or a star rating.
  • Leave contact details, before or during the chat, as you set.
  • Ask for a person with Talk to a person, when Hand-off to a person is on.
  • Come back to earlier conversations. An identified visitor’s conversations follow them to other devices.

The chat doesn’t set cookies or fingerprint devices. The agent gets page addresses without their query string or fragment.

Identify signed-in visitors

Section titled “Identify signed-in visitors”

When a visitor is signed in to your site, your server can tell the chat who they are. Their conversations then follow them to other devices.

Sign a short-lived JWT on your server with the website’s identity secret. Only HS256 is accepted.

Claim
sub Your user ID
email Required
name Optional
exp Required. The visitor counts as signed in until this time 
// On your server (Node.js, with the jose package)
import { SignJWT } from 'jose';


const token = await new SignJWT({ email: user.email, name: user.name })
  .setProtectedHeader({ alg: 'HS256' })
  .setSubject(user.id)
  .setExpirationTime('10m')
  .sign(new TextEncoder().encode(process.env.AUTERYN_IDENTITY_SECRET));

Then pass the token to the chat on your page:

Auteryn('identify', { token });

With npm, pass it to boot({ site, identity: { token } }); with React, <AuterynChat site="site_pub_…" identity={{ token }} />. When the user signs out, call Auteryn('shutdown') so the chat forgets them.

The chat refuses a token that is expired or signed with another secret. An email a visitor types in the chat is kept as a contact but never opens an existing customer’s conversations; only a signed token does.

The older userHash scheme also works. Pass { email, name, externalId, userHash }, with userHash set to the hex HMAC-SHA256 (keyed with the identity secret) of the lower-cased email and externalId joined by the byte 0x1F.

Control the chat from your page

Section titled “Control the chat from your page”

The script tag defines Auteryn(...). To queue calls made before it loads, add this line first:

<script>window.Auteryn=window.Auteryn||function(){(Auteryn.q=Auteryn.q||[]).push(arguments)};</script>
Auteryn('open');
Auteryn('close');
Auteryn('send', 'Do you ship to Ireland?');
Auteryn('context', { plan: 'pro' }); // facts about the visitor, up to 4 KB
Auteryn('shutdown');                 // on logout: forgets the visitor

context takes plain values (text, numbers, true or false). The agent reads them marked as unverified, since any page script can set them. With npm, boot() returns the same commands as methods (chat.open(), chat.identify({ token })).

Limits

Section titled “Limits”
Limit Value
Messages per visitor 20 every 10 minutes
New chat sessions per IP address 20 a minute
Replies per website 3,000 a day (UTC)
Message length 4,000 characters
File size 10 MB
Uploads per visitor 10 every 10 minutes
Allowed domains 32

Older installs

Section titled “Older installs”

Widgets with a wk_pub_ key, added before 26 September 2026, keep working with the snippet they were installed with:

<script>
  window.AgentForgeConfig = {
    apiKey: 'wk_pub_xxxxxxxx'
  };
</script>
<script src="https://unpkg.com/@agentforgelab/chat-widget@latest/dist/index.global.js" async></script>

Their settings stay in Edit settings on the widget’s connection. The page described above, with allowed abilities, the daily cap and numbers, is for websites added since. To move an older widget, add a website for the same domains, choose the same agent, and replace the old snippet with the new one. Visitors start new conversations after the switch.

Section titled “Related”