The ReqMe widget puts your AI assistant on your own website. Visitors ask questions, and when they are ready the assistant turns the conversation into a request that lands in your dashboard.

This guide is for adding the widget by hand, to a site you control the code of.

On WordPress, stop here #

Use the ReqMe WordPress plugin instead. It handles everything below for you and keeps your API key on your server, where it belongs. There is no reason to install the widget by hand on WordPress.

What you need first #

• Your API key, from Company in your ReqMe dashboard.
• The ability to edit your site’s HTML.
• Somewhere to run server-side code. This is not optional — see below.

Why you need a server #

The widget does not authenticate with your API key. It authenticates with a session token that lasts three minutes. Your server exchanges the key for a token; the browser only ever sees the token.

The key itself must never reach the browser. Anyone who reads your page source can copy it, and with it they can open sessions against your workspace, spend the conversations you pay for, and attach their own site to your account.

There is no way to change your API key from the app. If yours is exposed, the only remedy is to email hi@reqme.co. Treat it like a database password: it goes in an environment variable on your server, not in a template, not in a repository, not in a support screenshot.

If your platform cannot run server-side code — most Wix, Squarespace and Shopify themes, and any static site host without functions — do not embed the widget by hand. There is no safe way to do it, because the key would have to sit in the page. Share your public request page instead: it needs no key, no code and no maintenance.

Step 1 — load the script #

<script src="https://app.reqme.co/js/widget.min.js"></script>

You do not need to add a container element. The widget creates its own.

Step 2 — get a session token on your server #

Call this from your backend, with your key:

GET https://api.reqme.co/clients/create-client-session?apiKey=YOUR_API_KEY

It returns { "sessionToken": "..." }. The token is valid for three minutes, so fetch it when the page is served, not once at deploy time.

Expose a small endpoint of your own that returns the token and nothing else. Your page calls that endpoint; your key never leaves your server.

Step 3 — start the widget #

<script>
  document.addEventListener('DOMContentLoaded', async function () {
    try {
      // /api/reqme-token is YOUR endpoint, which returns { sessionToken }
      const res = await fetch('/api/reqme-token')
      const { sessionToken } = await res.json()

      window.ReqMe.init({
        sessionToken: sessionToken,
        // mode defaults to 'dock' (a bar along the bottom).
        // Use mode: 'button' for a floating launcher instead.
      })
    } catch (err) {
      console.error('ReqMe widget failed to start:', err)
    }
  })
</script>

Options #

init() accepts five options, and only these five:

• sessionToken — required. Without it the widget logs an error and does nothing.
• mode — 'dock' or 'button'. Defaults to 'dock'.
• dockWidth — 'standard', 'wide' or 'full'. Dock mode only. Defaults to 'standard'.
• buttonVersion — 'v1' through 'v7', the look of the floating button. Button mode only. Defaults to 'v7'.
• version — 'v1' or 'v2', the size of the panel that opens. Defaults to 'v2'.

An unrecognised value for any of these is not fatal — the widget warns in the browser console and falls back to the default.

Dock or button #

This is the choice that changes what your visitors actually see, so decide it before anything else.

• Dock (the default) — a bar fixed along the bottom of the page that a visitor can type into directly. It is always visible, so it invites more conversations, and it takes up space at the bottom of every page.
• Button — a floating launcher in a corner that opens a panel when clicked. Quieter, and out of the way.

Because dock is the default, doing nothing gives you the bar, not a button. To get the button instead, either pass mode: 'button' to init(), or put data-mode="button" on the script tag itself:

<script src="https://app.reqme.co/js/widget.min.js" data-mode="button"></script>

The attribute has to be on the widget’s own script tag — it is read at load time, not later. A value passed to init() wins over the attribute.

You can also open and close the widget yourself:

window.ReqMe.toggle()
window.ReqMe.show()
window.ReqMe.hide()

That is the whole interface. There are no event callbacks, no language option, and no per-domain settings. The assistant already answers in the visitor’s own language — see What your AI assistant can do.

Content Security Policy #

If your site sends a CSP header, the widget needs all five of these. The last three are the ones people miss, so check them first if the widget loads but shows nothing:

script-src  'self' https://app.reqme.co;
connect-src 'self' https://api.reqme.co;
frame-src   https://app.reqme.co;
style-src   'self' 'unsafe-inline' https://fonts.googleapis.com;
font-src    https://fonts.gstatic.com;

The widget renders inside a frame served from app.reqme.co, which is why frame-src is needed and why listing it under script-src alone is not enough. It also loads its typeface from Google Fonts, which is what the last two lines cover.

Checking it works #

• The dock bar appears along the bottom of the page — or the floating button, if you set mode: 'button'.
• Typing into it opens the assistant and it replies.
• Asking it to pass your details on creates a request in your dashboard.
• It behaves on a phone as well as a desktop.
• The browser console is clean.

Your own testing counts towards your conversation allowance — there is no exclusion for the account owner. See What is a conversation.

When something is wrong #

Nothing appears #

Open the console. The usual causes are the script not loading, init() running before the script has finished, or a token request that failed. A blocked CSP shows up here too.

It shows but nothing opens #

Usually frame-src missing from your CSP, or an expired token. A token is only good for three minutes — if you hard-coded one while testing, it is dead now.

It worked yesterday and not today #

Check that your server is fetching a fresh token on each page load rather than caching one.

It is hidden behind something #

A stacking-order clash with a sticky header or a cookie banner. Give the competing element a lower z-index.

Frequently asked questions #

Can I use one API key on several websites? #

Technically yes — the key is not tied to a domain. But every site shares one workspace, one conversation allowance and one request inbox, and a leak on any one of them exposes all of them. For genuinely separate businesses, use separate accounts.

Does the widget slow my site down? #

It loads separately from your page content and does not block rendering.

Can I track widget opens in Google Analytics? #

Not from the widget — it emits no events for you to hook. What you can measure is the result: conversations and the requests they produce, both visible in your dashboard.

Where do I see how the widget is performing? #

On the Conversations page, where you can filter by channel to see visitors who came through the widget, and on Requests for the deals that came out of it.

What happens if ReqMe is unavailable? #

The widget fails quietly. Your own pages are unaffected.

Getting help #

Include the page you are embedding on and anything in the browser console — it usually identifies the problem straight away.

Need help? #

If this page did not answer your question, send it to us. Tell us what you were trying to do and what happened instead — that is usually enough for us to spot the problem straight away.

Prefer email? hi@reqme.co