> ## Documentation Index
> Fetch the complete documentation index at: https://docs.karta.sh/llms.txt
> Use this file to discover all available pages before exploring further.

# Chat widget

> Drop a hosted, themeable agent chat widget onto any site with one async script tag.

The Karta chat widget is a prebuilt launcher + chat panel you embed with a
single async `<script>` tag. It renders into a Shadow DOM (so host-page CSS
cannot bleed in and the widget's CSS cannot leak out), streams replies from your
deployed Karta agent, and needs no backend of your own to get started.

This page gets a widget live in under five minutes. For driving it from your
page, see the [command API](/sdks/widget/command-api); for who the end user is,
see [identity](/sdks/widget/identity).

<Note>
  This page is for the deployed, drop-in widget. If you want to test a local
  frontend against `karta dev` before deploying, use the
  [support-bot tutorial](/tutorials/support-bot) or point your own custom UI at
  the local session API printed by `karta dev`.
</Note>

## What you need

* A **deployed Karta agent** (see the [Quickstart](/quickstart)).
* A **publishable embed key** (`pk_live_...`) from the agent's Embed tab.

<Note>
  The embed key is **publishable** - it is meant to ship in your page's HTML.
  It is not a secret like a `kt_live_...` API key. Its blast radius is fenced by
  the **allowed-origins allowlist** you set in the dashboard, not by hiding the
  key. See [Security & privacy](/security/chat-widget).
</Note>

## Get an embed key

<Steps>
  <Step title="Open the agent's Embed tab">
    In the dashboard, open your agent and go to the **Embed** tab.
  </Step>

  <Step title="Create an embed key">
    Create a key. The full `pk_live_...` value is shown **once** - copy it now
    (afterward only the prefix is shown; rotate to recover). The tab also gives
    you a ready-to-paste `<script>` snippet with the key and agent filled in.
  </Step>

  <Step title="Add your site's origin to the allowlist">
    Add every origin the widget will run on (scheme + host + port, e.g.
    `https://example.com`) to **Allowed origins**. A browser request from an
    origin not on the list is refused at token mint. There are no wildcards -
    list each origin explicitly.
  </Step>
</Steps>

## Add the script tag

Paste this once, near the end of your `<body>`. Replace the key and agent
with your own (or use the snippet the dashboard generated).

```html theme={null}
<script
  async
  src="https://cdn.karta.sh/widget/v1/karta.js"
  data-embed-key="pk_live_xxx"
  data-agent="coffeeco/support-bot"
></script>
```

That is the whole drop-in. The tag is `async`, so it never blocks your page; the
loader reads its own `data-*` attributes, lazily fetches the UI on demand, and
mounts a launcher in the corner.

## Expected result

A chat launcher appears in the bottom-right corner. Clicking it opens the panel
and starts a session against your agent; messages stream back token by token.
The look and copy (accent color, greeting, suggested prompts) are pulled from
the agent's Embed-tab config at runtime - so you can restyle the widget without
touching this tag. The displayed identity is the named Karta's name when the
key or URL selects one, and the underlying agent's name otherwise. See
[Theming & config](/sdks/widget/theming).

## Hosted surfaces

If you want an agent-bound URL instead of the generic CDN loader, use one of the
surfaces served from the agent host:

| Surface            | Path or snippet                                                                                                   | Use                                                                                                                                                                        |
| ------------------ | ----------------------------------------------------------------------------------------------------------------- | -------------------------------------------------------------------------------------------------------------------------------------------------------------------------- |
| Hosted chat page   | `https://agent.karta.sh/coffeeco/support-bot`                                                                     | Share a full-page chat for the deployed agent. Dashboard share links can append `?key=pk_live_xxx`; a bare hosted page mints its browser-safe token from the agent origin. |
| Chromeless iframe  | `https://agent.karta.sh/coffeeco/support-bot/embed`                                                               | Put the full chat panel inside your own frame or app shell.                                                                                                                |
| Agent-bound loader | `<script async src="https://agent.karta.sh/coffeeco/support-bot/embed.js" data-karta-key="pk_live_xxx"></script>` | Inject the same widget loader with the agent reference and runtime origin already baked in.                                                                                |

Use the generic CDN loader when you want all configuration on your own page. Use
the agent-bound loader when the agent coordinate should come from the URL itself.

## Customize inline

You can override any theme field on the tag with `data-theme-*`:

```html theme={null}
<script
  async
  src="https://cdn.karta.sh/widget/v1/karta.js"
  data-embed-key="pk_live_xxx"
  data-agent="coffeeco/support-bot"
  data-theme-accent="#d4ff4f"
  data-theme-greeting="Hi! Ask me anything about your order."
  data-theme-suggested-prompts="Track my order | Brewing tips | Talk to a human"
></script>
```

See the full attribute list in [Theming & config](/sdks/widget/theming).

## Where to go next

<CardGroup cols={2}>
  <Card title="Command API & events" icon="terminal" href="/sdks/widget/command-api">
    Open the widget from your own button, identify the user, and react to
    events with `karta(...)`.
  </Card>

  <Card title="Identity" icon="user-check" href="/sdks/widget/identity">
    Anonymous, soft, and verified (HMAC) identity - and which one to use.
  </Card>

  <Card title="Authenticated agent" icon="lock" href="/sdks/widget/authenticated-agent">
    Server-side recipe for signed-in users and step-up.
  </Card>

  <Card title="Theming & config" icon="palette" href="/sdks/widget/theming">
    The Embed-tab fields, runtime config, and the consent option.
  </Card>

  <Card title="Security & privacy" icon="shield-halved" href="/security/chat-widget">
    CSP directives, the origin allowlist, and the data path.
  </Card>
</CardGroup>
