Authentication and Headers

Request headers

Send:

• X-Widget-Publishable-Key on every widget endpoint in this reference.
• X-Visitor-Id on chat and lead requests. Use a random, opaque ID; do not use an email address or other personal information.
• Content-Type: application/json on requests with a JSON body.

Browser requests must come from a hostname allowed under Settings -> Security. The allowlist is deny-by-default: no configured domains means no widget origin is accepted. Allowing example.com also allows its subdomains.

Chat response headers

• X-Conversation-Id: the server-assigned conversation. Send it on later turns in the same active visit.
• X-Assistant-Message-Id: the stored assistant message. Use it when submitting thumbs feedback.
• X-Visitor-Id: the visitor ID accepted by the server.
• x-rag-context: URL-encoded JSON containing source summaries used by the answer.

Treat IDs as opaque strings. A conversation ID does not authorise access on its own; Engine 64 also checks the workspace, agent, visitor, and visit scope.

Rate-limit headers

When a request returns 429, wait for Retry-After before trying again. The response can include:

• Retry-After
• X-RateLimit-Scope
• X-RateLimit-Limit
• X-RateLimit-Remaining
• X-RateLimit-Reset