The website widget

The widget adds an Octy™ profile to the organisation’s website or intranet with one script tag. Visitors receive answers from the profile’s knowledge with their sources, under the profile’s controls.

The widget places an Octy profile on a page of a website or intranet: a launcher in the corner of the page that opens a panel with one question box. It answers from the profile’s knowledge, under the profile’s controls, and shows the evidence for each answer.

Setup

1. Open the profile in LightHouse™ (Agents → Octy profiles) and, on Settings, add the websites that will carry the widget under Allowed origins, each exactly as https://host or https://host:port.
2. Optionally, under Allowed pages, list the page paths where it may appear, such as /help/* or /policies/**. An empty list allows every page on the allowed origins.
3. Switch on the Website widget channel and save.
4. Open the Widget tab. Result: the tab shows the snippet and the content security policy entries.

The snippet

Place the snippet once, before the closing </body> tag, on each page where Octy should appear. For an Atlantic-hosted profile it reads:

<script src="https://ask.atlanticagenticlabs.com/octy/v1/customer-help/widget.js"
  data-octy-profile="customer-help"
  data-octy-api="https://ask.atlanticagenticlabs.com/api/v1/octy/customer-help"
  integrity="sha256-…" crossorigin="anonymous" async></script>

For a profile that runs in a client deployment, data-octy-api names the deployment’s Octy service, which answers the questions: https://YOUR-OCTY-HOST/v1/octy/p/customer-help. Replace YOUR-OCTY-HOST with the host on which Octy is published, behind the organisation’s own front door. The script is served by Atlantic and contains no data.

Copy the exact snippet for each profile from the Widget tab.

Content security policy

If the website’s pages send a Content-Security-Policy header, add the sources listed on the Widget tab:

Directive	Source	Purpose
script-src	https://ask.atlanticagenticlabs.com	The widget’s script
connect-src	https://ask.atlanticagenticlabs.com, or the deployment’s Octy host	The service that answers the widget’s questions
script-src and frame-src	https://challenges.cloudflare.com	The bot check, when it is on for the profile

The widget’s requests carry no credentials.

Pages and origins

The widget reads the profile’s allowed pages and hides itself on any other page. This affects display only. The service that answers checks the origin and the page of every request, and refuses a question from an origin or page the profile does not allow. See Controls.

The bot check, the evidence panel and receipts

• The bot check. For a profile with the bot check on, the widget shows a Cloudflare Turnstile check before a question may use a model. A visitor who has not passed it can still search. A public profile always has it on.
• The evidence panel. Each answer lists its sources, and the panel shows the passages it was written from.
• Receipts. Each answer’s signed receipt can be verified in the widget, against the published key of the profile that answered. See Evidence and question insights.

Deployment wake-up

A deployment that sleeps between questions may be starting when a question arrives. The widget then shows that Octy is starting, waits for the time the service gives, and asks again automatically. See Deployment profiles.

Integrity of the script

The widget’s script is served only if it matches the SHA-256 digest LightHouse holds for it, and the snippet carries the same digest as its integrity attribute. A browser refuses a script that does not match the digest.