The chat widget is a JS script you embed on your website (marketing, support, app). It opens a conversation window powered by one of your betool pipelines; the agent's replies are displayed as they are generated (streaming).
Features
- One snippet to paste into your page. No npm dependency; the widget lives in a Shadow DOM, so your site's CSS does not distort it (and vice versa).
- Public token — can be regenerated at any time from the editor. No secret on the client side.
- Per-tab continuity — the conversation identifier is kept in
sessionStorage: a page reload resumes the thread, closing the tab ends it. The widget sets no cookies. - 8 languages — the widget's interface follows the visitor's browser language.
- Anti-abuse safeguards active by default — 20 messages per minute per IP, 10 new sessions per minute per IP, 4,000 characters maximum per message (adjustable;
0disables a protection). A global cap per widget (20 times the per-IP limit) also blocks floods spread across multiple IPs.
Setup
- In the model editor, configure the Start node with a Chat (web widget) receiver.
- On save, betool generates the public token and displays the Embed snippet, ready to copy:
<script src="https://platform.betool.ai/widget/v1/widget.js"></script>
<script>
BetoolChat.init({ token: "<widget-public-token>" });
</script>
- Paste this snippet into the
<body>tag of your site. The widget appears automatically, at the bottom right by default.
Customization
From the receiver configuration:
- Appearance — displayed title, primary color, position (four corners), launcher shape (tab or bubble) and its label.
- Texts — welcome message, input field placeholder, status text (or a translated "online" display).
- Rendering — markdown display of replies (enabled by default).
- Page context — sends with each message the origin and path of the current page (never the query string). Enabled by default, can be disabled.
- Scope — restrict the allowed origins.
Security
The token is public by design: it only allows talking to the model that carries this receiver. If you list allowed origins, a request from another origin is refused server-side (403); an empty list (or *) imposes no restriction — reserve it for development. To revoke a compromised token: regenerate button next to the public URL, in the receiver configuration (all snippets already in production then stop working).