Enable the widget

The website widget lets visitors chat with one of your bots on your website without a Pegasus account. You paste one snippet into your site and Pegasus shows a chat button in the bottom-right corner.

Embed widget chat button on a sample site

What visitors and owners should expect#

When a visitor opens the widget, it greets them with "Hi! How can I help you today?" and Pegasus creates an anonymous visitor session. Visitors do not sign in. The bot owner sees widget traffic in usage figures, not as full widget-chat history.

If a visitor's message cannot be sent, the widget keeps the message and shows "Message not sent." with a Retry button.

The bot owner controls:

The widget is available on Free, Pro, and Ultra plans.

Visitors only see a working widget#

The widget appears on your site only when it can actually chat. If the bot is not Ready, the widget is turned off or removed, the token is wrong, or the website is not in Allowed websites, the chat button stays hidden from visitors. Instead, the browser console on your page shows a warning from the widget. See Widget troubleshooting.

Enable the widget#

1. Open the bot's Embed tab

   On the bot detail page, switch to the Embed tab. The side column shows the setup steps under How it works.

2. Click Turn on widget

   Pegasus creates the widget and its widget token. The switch now reads Widget is on.

3. Copy the embed code

   The Embed code section shows the snippet. Click Copy snippet.

4. Paste it into your website

   Put the snippet inside <body> on any page where you want the chat button. Most sites add it once in a shared layout or template.

5. Reload the page

   The chat button appears in the bottom-right corner when the bot is Ready. Click it to test.

Embed tab with the widget on and its embed code

If turning it on fails, Pegasus shows "Failed to enable the embed widget." Try again.

What the snippet contains#

The snippet is a <script> tag that loads the Pegasus widget and includes the widget token. No other secret is exposed.

The token is public on purpose because it identifies the bot to the widget. Real protection comes from Allowed websites, not from hiding the token in page source.

Turn the widget off or on#

Use the switch in the Website widget section of the Embed tab. It reads Widget is on or Widget is off. Turning it off stops new visitor chats right away and hides the chat button, but keeps the widget token and embed code. Turning it on again uses the same snippet.

Widget token and rotation#

The Widget token appears in the Embed code section. Use Copy token if you need the raw value.

Widget token with copy and rotate buttons

When to rotate the token#

Rotate the token when:

• You suspect the snippet is being used on an unintended site.
• You are handing off website ownership and want a fresh credential.
• You are following a regular security routine.

How rotation works#

Rotation invalidates the old token right away and creates a new one. Active visitor sessions stay valid for up to 2 hours, so live conversations do not drop mid-message, but any new page load must use the new snippet.

1. Click Rotate next to the token

   "Rotate widget token?" explains the impact.

2. Confirm

   Pegasus creates a new token and updates the Embed code section.

3. Update your website

   Copy the fresh snippet and replace the old one on your site before active sessions end.

Toast feedback:

• Success: "Token rotated. Update your embed snippet."
• Failure: "Failed to rotate token."

Even though the token is public, treat it carefully. If it appears in unrelated places, rotate it and tighten your Allowed websites list.

Allowed websites#

The widget can run on any website that loads your snippet. To limit it to your websites, fill in Allowed websites.

Allowed websites list with two URLs

How matching works#

Each entry is a website address with protocol, domain, and optional port, such as:

• https://example.com
• https://app.example.com
• http://localhost:3000

Matching is exact. https://example.com does not automatically include https://www.example.com.

Add or remove a website#

1. Open Allowed websites

   Go to the Embed tab for the bot.

2. Enter the full address

   Include the protocol. Invalid values show "Enter a valid URL (e.g. https://example.com)".

3. Click Add

   The website appears in the list immediately.

Click the remove button next to an entry to delete it. Removal takes effect immediately for new sessions.

Empty list means any website#

If the list is empty, Pegasus shows "Any website can show this widget." That is fine for testing, but not recommended for production.

Local development and wildcard limits#

• Add http://localhost:3000 or your actual local port for development.
• Do not rely on file:// pages; use a real local web server.
• Wildcards such as *.example.com are not supported, so list each subdomain explicitly.

Existing sessions after a change#

If you remove a website, active visitor sessions on that site may finish their current message, but new sessions cannot start there.

After enabling#

Once the widget is live, you can rotate the token, limit the allowed websites, or remove the widget if you need a full reset.