Install the widget

One script tag. No build step, no package to install, and nothing to configure in your code — everything about how the widget behaves is set in the dashboard, not in the snippet.

The snippet

Copy it from Install in the dashboard, which fills in your own key. It looks like this:

<script src="https://api.atalai.com/widget.js"
        data-key="wk_live_…" async></script>

Put it before </body> on every page you want the bot on. async matters: without it the browser stops building your page until the script arrives, which makes a support widget part of how fast your site feels.

The key is not a secret

data-key is a publishable key. It identifies which bot to load and is visible to anyone who views source, exactly like a Google Analytics id — that is normal and is not the thing protecting you.

What protects you is the origin allow-list. Add your domains under Install → Allowed origins, and the API will refuse a chat request from anywhere else, so somebody who copies your key onto their own site gets nothing.

Leave the list empty and the widget answers from anywhere. That is the right setting while you are testing on a local machine and the wrong one to leave in place afterwards.

Single-page apps

The widget attaches itself once and survives client-side navigation, so React, Vue and Next apps need the tag in the root layout and nothing else. Do not add it per route — two tags load two widgets.

Checking it works

• The launcher appears in the corner you chose under Install.
• A first message comes back within a few seconds. If it returns immediately with an error, the origin is not on the allow-list.
• The chat appears in Chats in the dashboard within a moment of ending.

If the launcher never appears, open your browser console. A blocked request names the reason, and the two common ones are an origin that is not allowed and a content-security policy on your own site that does not permit the script.

Content Security Policy

If your site sets a CSP, the widget needs script-src and connect-src to include the API host. Without it the browser blocks the script silently as far as your visitors are concerned — nothing appears, and nothing is logged anywhere you would look.

Create an account to get a key, or read what to upload next.