Script Loader

The one-tag iframe embed — data attributes, the window.Wexio() API, and pre-boot settings

The script loader is the simplest install: one <script> tag that injects an iframe-sandboxed widget. It works on any host page — plain HTML, a CMS, a WYSIWYG block — and needs no build step.

Basic embed

Drop this before the closing </body> tag:

<script
  async
  src="https://cdn.wexio.io/widget/loader.js"
  data-public-key="pk_live_..."
></script>

The loader injects an <iframe>, listens for resize/open/close messages, and positions the launcher in the corner.

Script data attributes

Read from the <script> element at load time:

Attribute	Default	Purpose
`data-public-key`	— (required)	Your widget's public key. The loader aborts with a console warning if it's missing.
`data-origin`	`https://cdn.wexio.io`	Override the widget CDN base.
`data-api`	`https://api.wexio.io`	Override the backend API base.
`data-hide-attribution`	`false`	Hide the visible "Powered by Wexio" chip. The link stays in the DOM (hidden) for SEO.

Imperative API: `window.Wexio()`

Call window.Wexio(action, ...args) to control the widget at runtime:

Action	Argument	Effect
`"identify"`	`VisitorIdentity` or `null`	Log a known visitor in (or `null` to log out). See Authentication.
`"prefill"`	`{ name?, email?, phone? }`	Pre-fill the prechat form (unverified).
`"shutdown"`	—	Clear the visitor's identity and start a fresh anonymous session.
`"show"`	—	Show the iframe.
`"hide"`	—	Hide the iframe.

Pre-load queue

Calls made before the loader finishes are buffered if you install the standard stub first:

<script>
  window.Wexio = window.Wexio || function () {
    (window.Wexio.q = window.Wexio.q || []).push(arguments);
  };
  window.Wexio("identify", { jwt: "..." });
  window.Wexio("prefill",  { email: "ada@example.com" });
</script>
<script async src="https://cdn.wexio.io/widget/loader.js" data-public-key="pk_live_..."></script>

Pre-boot settings

Set window.wexioSettings before the loader runs to pass identity and prefill up front:

<script>
  window.wexioSettings = {
    user: {
      jwt: "<host-signed-jwt>",      // or googleIdToken, or userId + userHash
      name: "Ada Lovelace",
      email: "ada@example.com",
    },
    prefill: {
      name: "Ada Lovelace",
      email: "ada@example.com",
    },
  };
</script>
<script async src="https://cdn.wexio.io/widget/loader.js" data-public-key="pk_live_..."></script>

Prefill from the URL

The loader also reads wx_name, wx_email, and wx_phone query-string parameters from the host page URL and merges them into prefill.

URL parameters leak through browser history, server logs, and the Referer header. Prefer window.wexioSettings.prefill for anything sensitive. Prefill is never identity — see Sessions & prefill.

The iframe is fixed-positioned by the loader (the host can't override it via CSS): bottom-right by default, 400 × 640 px, with a 2147483647 z-index so it always sits on top. It flips to bottom-left when the widget's launcherPosition is set to left. The iframe URL is <origin>/?pk=<public-key>&referer=<host-url> (with &lang=… appended when a locale is resolved).

Authentication — identify visitors with JWT / HMAC / Google.
API reference — every data attribute, action, and postMessage type.