Script Loader
The one-tag iframe embed - data attributes, the window.Wexio() API, and pre-boot settings
The script loader is a one-tag install. One <script> tag injects an iframe-sandboxed widget. It works on any host page (plain HTML, a CMS, a WYSIWYG block) and needs no build step.
Basic Embed
Add this before the closing </body> tag:
<script
async
src="https://cdn.wexio.io/widget/loader.js"
data-public-key="pk_live_..."
></script>The loader injects an <iframe>, listens for resize/open/close messages, and positions the launcher in the corner.
Script Data Attributes
The loader reads these from the <script> element at load time:
| Attribute | Default | Purpose |
|---|---|---|
data-public-key | - (required) | Your widget's public key. The loader aborts with a console warning if it's missing. |
data-origin | https://cdn.wexio.io | Override the widget CDN base. |
data-api | https://api.wexio.io | Override the backend API base. |
data-hide-attribution | - | Ignored. The loader never shows an attribution link to visitors, so there is nothing to hide. |
The window.Wexio() API
Call window.Wexio(action, ...args) to control the widget at runtime:
| Action | Argument | Effect |
|---|---|---|
"identify" | VisitorIdentity or null | Log a known visitor in (or null to log out). See Authentication. |
"prefill" | { name?, email?, phone? } | Pre-fill the prechat form (unverified). |
"shutdown" | - | Clear the visitor's identity and start a fresh anonymous session. |
"theme" | "light", "dark" or "auto" | Switch the widget theme, for example from your dark-mode toggle. |
"show" | - | Show the iframe. |
"hide" | - | Hide the iframe. |
"open" / "close" | - | Open or close the panel. |
"navigate" | { tab, article? } | Go to home, messages, help, news or profile, or to a help article { kind: "help", slug } or news post { kind: "news", id }, and open the panel. |
Calls made before the widget is ready are queued and run when it is. Closing the panel never hides the launcher. Use "hide" for that.
Pre-Load Queue
The loader buffers calls made before it finishes, if you add the standard stub first:
<script>
window.Wexio = window.Wexio || function () {
(window.Wexio.q = window.Wexio.q || []).push(arguments);
};
window.Wexio("identify", { jwt: "..." });
window.Wexio("prefill", { email: "ada@example.com" });
</script>
<script async src="https://cdn.wexio.io/widget/loader.js" data-public-key="pk_live_..."></script>Pre-Boot Settings
To pass identity and prefill up front, set window.wexioSettings before the loader runs:
<script>
window.wexioSettings = {
user: {
jwt: "<host-signed-jwt>", // or googleIdToken, or userId + userHash
name: "Ada Lovelace",
email: "ada@example.com",
},
prefill: {
name: "Ada Lovelace",
email: "ada@example.com",
},
};
</script>
<script async src="https://cdn.wexio.io/widget/loader.js" data-public-key="pk_live_..."></script>Open on Load and Launcher Offset
Four more keys work in window.wexioSettings:
defaultOpen: true. Opens the panel once the widget is ready.theme: "light" | "dark" | "auto". Sets the widget theme on first paint. To switch it later, callwindow.Wexio("theme", "dark").configOverride. A partial config merged over the saved one, for presentation only. See Overrides.offset: { x, y }. Moves the launcher away from its corner in px, to clear a cookie banner or a back-to-top button. Each axis is clamped to 0-200.
The loader also dispatches wexio:open, wexio:close, wexio:resize and wexio:message-action as events on window.
Prefill From the URL
The loader also reads wx_name, wx_email, and wx_phone query-string parameters from the host page URL and merges them into prefill.
URL parameters leak through browser history, server logs, and the Referer header. Prefer window.wexioSettings.prefill for anything sensitive. Prefill is never identity - see Sessions & prefill.
Positioning
The loader fixes the iframe in place, and the host can't override it with CSS. The iframe sits bottom-right by default, with a 2147483647 z-index so it stays on top. It flips to bottom-left when the widget's launcherPosition is set to left. The frame is as small as the launcher while the panel is closed, grows to the panel size when it opens, and never exceeds the browser window.
The iframe URL is <origin>/?pk=<public-key>&referer=<host-url>, with &lang=… appended when a locale is resolved.
Lightbox and Clicks Around the Launcher
- When a visitor opens an image in the full-screen lightbox, the loader stretches the frame over the whole host page, so the image covers the page and not only the panel.
- While the panel is closed, the frame only captures clicks on the launcher and its message bubble. Clicks and text selection around them reach your page.
Related
- Authentication - identify visitors with JWT, HMAC, or Google.
- API reference - every data attribute, action, and postMessage type.
- Script loader example - a full HTML page you can copy.