Connect website chat, email, SMS, voice, and custom apps

The website widget uses the tenant public key to load branding, catalog cards, conversation history, and customer-safe chat endpoints. The key identifies the tenant but is not an administrator credential. Access is restricted by the exact website origins saved in ConveRact.

Add every production origin exactly, including scheme and port when applicable. Do not add a wildcard. Test desktop, mobile, navigation, multiple tabs, returning conversations, product cards, payment links, human handover, and loading or offline behavior.

Email delivery is configured under Settings before the Email channel is enabled. Obtain the SMTP host, port, encryption mode, username, password or app password, and approved From address from the client email provider.

ConveRact can use the verified sender for quotes, receipts, invoices, invitations, notifications, and configured customer communication. Provider authentication, sending limits, and domain reputation still belong to the client.

SMS requires a provider-specific transport adapter. ConveRact currently labels the channel Adapter required until a supported Twilio-compatible or custom transport is configured. Do not mark SMS live using demo credentials.

Before launch, obtain the messaging number, provider credentials, sender registration where required, inbound and status webhook configuration, consent language, opt-out keywords, quiet hours, and regional compliance approval.

Voice configuration is stored server-side. ConveRact needs the restricted ElevenLabs API key, Agent ID, Voice ID, and selected model. Phone calls additionally need a supported number or SIP connection and region-specific consent, recording, quiet-hour, and caller-identification controls.

Test the secure browser voice session before enabling telephony. Then validate interruption, silence, latency, pronunciation, tool permissions, transfer, hangup, transcript delivery, and failure recovery.

Use the public widget API for customer-facing chat and catalog access. Use a scoped workspace API key for approved server-to-server product, quote, payment, customer, or lead operations. Never place an atl_ workspace API key inside browser or mobile application code.

Choose the smallest permissions required, set an expiry, store the key in the client backend or secret manager, and revoke it immediately when ownership changes. Use unique idempotency references for commercial actions and verify every inbound webhook signature.

A connection is ready only when a real external account can send a message, ConveRact resolves the correct tenant, the AI uses verified business data, the provider receives the reply, staff can take over, and failures are visible. A green credential test alone is not an end-to-end launch.

Keep separate development and production credentials. Assign owners for provider billing, credentials, templates, domain verification, customer consent, incident response, and AI quality. Re-test after changing any provider app, token, phone number, Page, account, domain, prompt, catalog source, or payment configuration.