Chatbot API

Most teams should use the script tag. Developers can call the chatbot API directly for custom interfaces.

Configuration handshake

POST /api/cxo/config
Content-Type: application/json

{
  "api_key": "cxo_live_xxx",
  "origin": "https://example.com",
  "url": "https://example.com/pricing"
}

The handshake validates the key and allowed origin, then returns widget configuration, a session_id, and a short-lived JWT token for subsequent calls.

Send message

POST /api/cxo/chatbot
Content-Type: application/json

{
  "token": "eyJ...",
  "session_id": "sess_123",
  "message": "I need help with billing",
  "context": { "page_url": "https://example.com/pricing" }
}

The endpoint returns 202 with a run_id and status: "processing". Direct api_key authentication is still supported for backward compatibility, but the widget path should use the JWT returned by the config handshake.

Poll history or use the streaming endpoint when enabled.

Poll history

GET /api/cxo/history?session_id=sess_123&api_key=cxo_live_xxx

GET /api/cxo/stream?session_id=sess_123&token=eyJ...

Never expose a management API key in browser code. Use only widget or product-scoped keys client-side.