Authentication

How it works

Your Bot ID

Every bot has a unique UUID assigned at creation time. This ID:

• →Identifies which bot to load and chat with
• →Is embedded in the widget script URL
• →Is publicly visible; it is not a secret (unlike the REST API key)

Your Bot ID (example)

a1b2c3d4-e5f6-7890-abcd-ef1234567890

Find your real Bot ID in Dashboard → Deployment.

Widget authentication

Snippet

For the widget embed, authentication is implicit: your Bot ID is part of the script URL. No extra configuration is needed, and the widget handles every call it makes from there on its own.

<!-- Your Bot ID is embedded in the script URL -->
<script data-cfasync="false">
  (function () {
    var s = document.createElement("script");
    s.src = "https://equilai.ai/api/widget/script/YOUR_BOT_ID.js";
    s.async = true;
    document.head.appendChild(s);
  })();
</script>

REST API authentication

Server-side API key

The server-side REST API uses a secret API key instead of the Bot ID. Create one in Dashboard → API, then send it in the JSON body as apiKey. Unlike the Bot ID, this key is a secret: keep it on your server and never expose it in client-side code. See the API reference →

POST /api/chat/start

{ "apiKey": "YOUR_API_KEY" }

Security

Domain restrictions

Because the Bot ID is public, the widget's requests are also validated by origin domain. You control which sites may embed your bot in Dashboard → Bot → Allowed Domains. The REST API is not domain-restricted; its secret key is the credential.