Widget Security and Visitor Identity

The hosted Convor widget handles its own browser session and realtime connection. A normal website integration does not need to reproduce the widget's session or transport flow.

Public widget keyCopy Anchor Link

Install the widget with the code copied from Settings → Widget → Installation and security:

<script
  src="https://cdn.convor.io/widget.js"
  data-key="convor_wpk_..."
  async
></script>

A convor_wpk_… value is a public widget key. It identifies the site whose widget configuration should be loaded and is expected to be visible in the page source.

Allowed domainsCopy Anchor Link

Restrict the widget to the hostnames where it should appear. A copied public widget key does not make another domain an approved installation.

When testing your own application locally, add the local hostname temporarily. Remove unused development origins before going live.

Anonymous and signed-in visitorsCopy Anchor Link

The widget maintains the anonymous visitor session for you. Use the browser API when your application has additional context:

• Convor.setUser() adds self-reported contact details and application metadata;
• Convor.setAttributes() adds application-specific visitor attributes;
• Convor.setPage() synchronizes a route when your router does not update the browser URL normally;
• Convor.resetVisitor() starts a new anonymous identity, for example after a user signs out on a shared browser.

Self-reported browser data is not proof of account ownership.

Verified signed-in identityCopy Anchor Link

When your application already authenticates the customer, enable Verified customer identity for the site and generate its signing secret. Store the secret only on your server.

Your browser obtains the current Convor visitor ID. Your authenticated backend then resolves the customer from its own session, signs the exact identity data, and returns the signed identity to the same browser session. The browser passes that result to Convor.identify().

The exact HMAC-SHA256 payload, field order, server example, and browser call are documented in Convor.identify(identity).

Use supported integration surfacesCopy Anchor Link

For browser integrations, use the Widget JavaScript API. For server-to-server automation, use the customer API reference. For event delivery to your backend, use outbound webhooks.

Use the documented browser API, customer REST API, and outbound webhooks as the supported integration surfaces. The hosted widget manages its own connection and session details.