Website widget
Update an old embed (data-api-key)
Embeds from before widget.js 1.8 used a secret key and no longer load. Replace the tag and protect your secret key.
Troubleshooting1 min readUpdated 23 October 2026
Before widget.js 1.8, the embed code carried data-api-key with your secret sk-so- key. Anyone could copy that key from your page source and use it to call your agents. Version 1.8 refuses those tags: the widget doesn't load and the browser console says why.
<!-- Old embed: no longer loads --><script src="https://app.sentientone.ai/widget.js" data-api-key="sk-so-…" data-agent-id="…"></script>Steps
- 1
Open the agent's Deploy tab
This makes the agent's publishable
pk-so-key if it doesn't have one yet. - 2
Add your websites
List every domain the widget runs on under Allowed websites and save. Without them the new widget only answers inside the app.
- 3
Replace the tag
Copy the new embed code and replace the old tag on every page or template.
- 4
Deal with the exposed secret key
Your secret key was public while the old tag was live. There is no self-serve rotation for the secret key yet; email support@sentientone.ai from your account address and we'll help. Meanwhile, watch Tracing for traffic you don't recognise.
You're done when
View source on your site shows data-widget-key="pk-so-…" and no data-api-key, and the widget answers.
If something goes wrong
The console says "This chat isn't set up correctly" after updating
The key and agent id don't match, or the key is mistyped. Copy the whole tag again from the Deploy tab rather than editing attributes by hand.
Can I keep a secret key in a page if my site is private?
No. Secret keys sent on the widget path are refused with SECRET_KEY_NOT_ALLOWED regardless of where the page lives. Use the publishable key, or call the API from your own server.
Related
Still stuck?
Email us with what you tried and any request id. A person replies.