Website widget
One script tag. No secret on the page.
Paste the embed code and your agent answers on your website: same prompt, knowledge and tools, streamed replies, every conversation in your dashboard. The key in the tag is publishable, so anyone can read it and nobody can misuse it.
200 free credits when you sign up. No card needed.
Embed it
The agent's Deploy tab writes this tag for you, with its key and your choices filled in. Put it before the closing body tag, or in your site builder's custom code.
<script src="https://app.sentientone.ai/widget.js" data-widget-key="pk-so-…" data-agent-id="YOUR_AGENT_ID" data-style="bubble" data-color="#111111" data-bot-name="Support" data-welcome="Hi! How can I help you today?" defer></script>Works anywhere you can add a script: plain HTML, Next.js, WordPress, Shopify, Webflow, Squarespace. The Deploy tab's Test on this page loads the widget inside the app so you can try it before it goes live.
Options
data-widget-key | The agent's publishable key (pk-so-…). Required |
|---|---|
data-agent-id | The agent. Required |
data-style | bubble, panel or popup |
data-color | The accent colour, any hex value |
data-bot-name | The name shown in the header |
data-welcome | The first message visitors see |
Publishable keys
The widget never carries your secret sk-so- key. Each agent has one publishable pk-so- key, made when you open its Deploy tab, that can do exactly one thing: chat with that agent.
- It only reaches its own agent (403 WIDGET_KEY_SCOPE for any other), and only while the agent is active.
- Visitors can't override the prompt, send their own model key, or reach unpublished agents.
- It only continues its own agent's conversations.
- Rotate it from the Deploy tab; the old key stops working within 10 seconds.
- Secret keys sent on the widget path are refused outright (401 SECRET_KEY_NOT_ALLOWED), so a leaked server key can't be put to work in someone else's page.
Allowed websites
A publishable key only works on the websites you list on the Deploy tab. The API checks each request's Origin header, or its Referer when there's no Origin, and refuses others with 403 ORIGIN_NOT_ALLOWED.
example.com | example.com and www.example.com |
|---|---|
*.example.com | example.com and every subdomain |
example.com:8080 | That port only |
| Empty list | Only the preview inside the SentientOne app |
| Maximum | 50 websites per key |
Limits
Limits are checked before any credit is spent, so a busy page or a script hammering your widget can't drain your balance quickly.
| Per key | 120 requests a minute |
|---|---|
| Per visitor | 12 requests a minute per IP address (stored hashed) |
| Per agent | The agent's own requests-per-minute limit still applies |
| Credits | 1 credit per reply from your balance; at zero, visitors see "This assistant is unavailable right now" and you get an email |
Older embeds
Embeds from before widget.js 1.8 used data-api-key with a secret key. They no longer load: the browser console says why. Copy the new tag from the agent's Deploy tab and replace the old one, then rotate the secret key that was on the page.
Put an agent on your site before lunch
Sign up and you get 200 free credits, no card needed. Create an agent, add your knowledge, try it in the Playground, then call it from your code or put it on your website.