Web chat widget

Quickstart

1. 1 In your workspace, open Settings → Web chat and enable the widget.
2. 2 Add each site origin that may load the widget under Allowed origins.
3. 3 Copy the embed snippet and paste it just before the closing </body> tag.

<script src="https://widget.rosettachat.app/widget.js" data-site="wgt_..." async></script>

Signed visitor identity (optional)

If your visitors are already logged in, prove their identity so agents see a Verified badge and the conversation carries a stable external_user_id. Generate a signing secret in Settings → Web chat, then sign a token on your backend and pass it via data-identity. Never expose the secret to the browser.

import crypto from 'node:crypto';

function signIdentity(secret, payload) {
  const b64 = Buffer.from(JSON.stringify(payload)).toString('base64url');
  const sig = crypto.createHmac('sha256', secret).update(b64).digest('hex');
  return `${b64}.${sig}`;
}

const token = signIdentity(process.env.ROSETTA_IDENTITY_SECRET, {
  external_user_id: user.id,
  name: user.name,
  email: user.email,
});

Webhooks

Subscribe to conversation.created, conversation.closed, and (opt-in) message.created. Each delivery is signed with X-Rosetta-Signature: t=<unix>,v1=<hmac_sha256("t.body", secret)>. Verify it with the secret shown once when you create the webhook.

Test mode

Use the sandbox embed snippet (a separate test key) while developing. Its conversations are flagged as tests, excluded from your support usage, hidden from the default inbox, and auto-purged.