Widget Config API

Endpoint:


GET /api/widget/config

The config response is safe for a browser. It does not contain the system prompt, private credentials, or private workspace data.

Required header

X-Widget-Publishable-Key: <key>

Example request


curl "https://your-domain.com/api/widget/config" \
  -H "X-Widget-Publishable-Key: wpk_live_xxx"

Example response


{
  "assistantName": "Support Agent",
  "initialMessage": "Hi! How can I help you today?",
  "themeColor": "#fe551a",
  "avatarUrl": null,
  "suggestedQuestions": ["How do I get started?"],
  "removeBranding": false,
  "leadCaptureMode": "smart",
  "allowedDomains": ["example.com"],
  "messageRateLimitCount": 5,
  "messageRateLimitWindowSec": 30,
  "rateLimitExceededMessage": "Too many messages in a row. Please wait a moment and try again.",
  "serviceStatus": "ok",
  "unavailableMessage": null
}

leadCaptureMode is off, required_before_chat, or smart. If serviceStatus is blocked, show unavailableMessage instead of enabling chat.

Responses may be cached briefly. Clients should ignore unknown fields so additive changes do not break the widget.

Errors

401: missing/invalid publishable key
403: domain not allowed
404: agent not found