Deployment
Most integrations are a single tag on an existing page. Where a strict content-security policy rules that out, the same bundle runs inside an API-origin frame instead.
Embed models
One script tag, isolated styles
The default. A single script mounts the assistant inside a shadow root, so your styles and ours cannot collide. Your own header button can open it by dispatching a window event — no reference to the widget required.
For strict content-security policies
The same bundle loads the assistant inside an iframe served from the API origin. All widget code and network calls live in that frame; the host page carries a transparent iframe that resizes itself as the chat opens.
<script
src="https://widget.opensupport.me/opensupport-widget.iife.js"
data-public-key="pk_your_key"
data-api-base="https://api.opensupport.me"
></script>Multi-tenant isolation
Each deployment gets its own public key, bound to the origins you nominate. A key lifted from your page does not work anywhere else.
A tenant can be restricted to a defined portfolio or to its own private content, enforced during retrieval rather than filtered afterwards.
Feature flags, prompt configuration, webhooks and pharmacovigilance routing are per tenant, so one deployment’s settings never leak into another.
Usage events and daily rollups are recorded per tenant, so consumption and cost attribution follow the deployment.
For pharma & life sciences
Most first deployments are a tag on a single brand page. We will provision a scoped key and help you size it from there.