Widget Runtime Behaviour

The supplied widget manages these identifiers for you. Custom clients need to understand their roles:

X-Widget-Publishable-Key selects the agent and workspace.
X-Visitor-Id is an anonymous browser identifier used across visits.
visitId identifies the current website visit and can be shared across tabs.
conversationId is the server-assigned chat session returned after the first message.

What happens when a visitor sends a message

For each user message:

The latest user message is validated. The maximum length is 4000 characters.
Engine 64 resumes a conversation only when the visitor, visit, and supplied conversation all belong together.
Relevant source material is retrieved and passed through the chat safety pipeline.
The configured model streams a response.
Conversation and assistant-message IDs are returned in response headers. Source summaries are returned in the URL-encoded x-rag-context header.

When a conversation continues or restarts

The anonymous visitor ID can persist, but it does not force every future visit into one endless chat. The widget sends presence heartbeats while a conversation is active. After those heartbeats stop and the visit expires, a later visit begins a new conversation.

Treat every ID as opaque. Do not place an email address or other personal information inside a visitor or visit ID.

Rate limits

The visitor-specific message limit is configured under Settings -> Security and defaults to 5 messages every 30 seconds. It can be set from 1–100 messages over a 1–3600 second rolling window.

Engine 64 also applies fixed platform safeguards over 60 seconds:

per IP address: 90 chat requests;
per publishable key: 120 chat requests; and
the configured per-visitor limit, falling back to the platform default only when no valid agent value is available.

When a limit is exceeded, the API returns 429 with Retry-After and X-RateLimit-* headers. Wait for the specified interval; repeatedly retrying will not bypass the limit.

Voice Input

The widget can transcribe microphone audio into editable text before the visitor sends it.

Voice input requires HTTPS because browser microphone access depends on getUserMedia().
Iframe embeds must allow microphone access. The hosted widget script sets allow="microphone" on the iframe automatically.
Browser support varies more than plain text chat, so voice input should be treated as a progressive enhancement rather than the primary input path.