Install and integrate CaaS

Embed

One stable public site ID is embedded. Rotating runtime tokens never requires editing the host website.

<script src="https://cdn.example.com/caas/v1/bot.js"
        data-config="site_xxxxx"
        async></script>

Host-page API

window.CaaSChat.open();
window.CaaSChat.close();
window.CaaSChat.setLanguage('ar');
const unsubscribe = window.CaaSChat.on('message', event => {});

Anonymous identity

Anonymous identity is only an untrusted correlation handle. It never becomes trusted customer identity.

await window.CaaSChat.identify({ anonymousId: 'browser-user-123' });

Verified identity

Create an identity signing key in Install → Verified visitor identity. Keep the secret on your server. Sign an HS256 JWT with audience caas:identify, the exact public site ID, a stable subject, and an expiry no longer than 24 hours.

{
  "iss":"your-app.example",
  "aud":"caas:identify",
  "site":"site_xxxxx",
  "sub":"customer_42",
  "iat":1720000000,
  "exp":1720000300,
  "claims":{"name":"Aisha","accountId":"A-42","locale":"ar"}
}

const token = await yourServer.getCaaSIdentityToken();
await window.CaaSChat.identify(token);

Never put the signing secret in browser JavaScript.

Signed webhooks

Webhook deliveries include an event ID, timestamp and HMAC signature. Reject stale timestamps and replayed event IDs.