# The website widget

> Adding an Octy profile to a website or intranet with one script tag: the snippet, the content security policy, origins and pages, the bot check and the evidence panel.

The widget adds an Octy™ profile to the organisation’s website or intranet with one script tag. Visitors receive answers from the profile’s knowledge with their sources, under the profile’s controls.

The widget places an Octy profile on a page of a website or intranet: a launcher in the corner of the page that opens a panel with one question box. It answers from the profile’s knowledge, under the profile’s controls, and shows the evidence for each answer.

## Setup

1. Open the profile in LightHouse™ (**Agents → Octy profiles**) and, on **Settings**, add the websites that will carry the widget under **Allowed origins**, each exactly as `https://host` or `https://host:port`.
2. Optionally, under **Allowed pages**, list the page paths where it may appear, such as `/help/*` or `/policies/**`. An empty list allows every page on the allowed origins.
3. Switch on the **Website widget** channel and save.
4. Open the **Widget** tab. Result: the tab shows the snippet and the content security policy entries.

## The snippet

Place the snippet once, before the closing `</body>` tag, on each page where Octy should appear. For an Atlantic-hosted profile it reads:

```html
<script src="https://ask.atlanticagenticlabs.com/octy/v1/customer-help/widget.js"
  data-octy-profile="customer-help"
  data-octy-api="https://ask.atlanticagenticlabs.com/api/v1/octy/customer-help"
  integrity="sha256-…" crossorigin="anonymous" async></script>
```

For a profile that runs in a client deployment, `data-octy-api` names the deployment’s Octy service, which answers the questions: `https://YOUR-OCTY-HOST/v1/octy/p/customer-help`. Replace `YOUR-OCTY-HOST` with the host on which Octy is published, behind the organisation’s own front door. The script is served by Atlantic and contains no data.

Copy the exact snippet for each profile from the **Widget** tab.

## Content security policy

If the website’s pages send a `Content-Security-Policy` header, add the sources listed on the **Widget** tab:

| Directive                    | Source                                                               | Purpose                                         |
| ---------------------------- | -------------------------------------------------------------------- | ----------------------------------------------- |
| `script-src`                 | `https://ask.atlanticagenticlabs.com`                                | The widget’s script                             |
| `connect-src`                | `https://ask.atlanticagenticlabs.com`, or the deployment’s Octy host | The service that answers the widget’s questions |
| `script-src` and `frame-src` | `https://challenges.cloudflare.com`                                  | The bot check, when it is on for the profile    |

The widget’s requests carry no credentials.

## Pages and origins

The widget reads the profile’s allowed pages and hides itself on any other page. This affects display only. The service that answers checks the origin and the page of every request, and refuses a question from an origin or page the profile does not allow. See [Controls](/octy/controls/#allowed-origins-and-pages).

## The bot check, the evidence panel and receipts

- **The bot check.** For a profile with the bot check on, the widget shows a Cloudflare Turnstile check before a question may use a model. A visitor who has not passed it can still search. A public profile always has it on.
- **The evidence panel.** Each answer lists its sources, and the panel shows the passages it was written from.
- **Receipts.** Each answer’s signed receipt can be verified in the widget, against the published key of the profile that answered. See [Evidence and question insights](/octy/evidence/).

## Deployment wake-up

A deployment that sleeps between questions may be starting when a question arrives. The widget then shows that Octy is starting, waits for the time the service gives, and asks again automatically. See [Deployment profiles](/octy/where-it-runs/#deployment-profiles).

## Integrity of the script

The widget’s script is served only if it matches the SHA-256 digest LightHouse holds for it, and the snippet carries the same digest as its `integrity` attribute. A browser refuses a script that does not match the digest.

Source: https://docs.atlanticagenticlabs.com/octy/widget/