Embedding it on your site

One script tag, anywhere in the HTML:

It loads after your page, draws a button in the corner, and opens the chat in an isolated frame so nothing in it can touch your page's styles, scripts or cookies — and nothing on your page can read the conversation.

The key is public, and that is fine

It appears in your page source, as it must. What protects you is the domain allowlist, not secrecy: a request carrying your key from a domain you did not list is refused. In the normal website setup, someone can read your key but cannot use it from another site.

So list your real domains and no others. Add www. if you serve it, and add your staging domain while you are testing. If you deliberately enable no-origin access for a mobile app, use install registration as described in the mobile guide.

The allowlist is a browser control. A custom API client can forge an Origin header, so do not treat the public key as an API secret.

Where it goes

• Webflow — Project settings → Custom code → Footer code.
• Squarespace — Settings → Advanced → Code injection → Footer.
• WordPress — a snippet plugin, or your theme's footer template. Avoid pasting into a post: it will only load on that post.
• Shopify — Online store → Themes → Edit code → theme.liquid, just before </body>.
• Framer, Wix, Carrd — each has a custom-code or embed panel that runs site-wide. Use the site-wide one, not a per-page block.
• Hand-written HTML — before </body>.

Conversations resume by themselves

The widget keeps a conversation id in the browser's local storage, so a visitor who navigates to another page or comes back later finds the same conversation. The id is signed, so a visitor cannot edit it into somebody else's chat.

If your site has a backend and you would rather control conversation identity yourself — one thread per logged-in customer, say — that is supported too: your server mints a short-lived signed token instead of using the public key. Ask us and we will walk you through it.

Content-Security-Policy

If your site sends a CSP, add https://kavilo.cloud to the existing script, frame and connection directives:

A blocked widget is silent in the page but loud in the browser console — check there first if nothing appears.

Removing it

Delete the script tag. Nothing else is left behind on your site. Delete the bot in the portal to invalidate its key, so any embed you missed stops working immediately. Deleting the bot does not immediately erase stored conversations or captured leads; those remain until the retention sweep.