PeopleTide CRM
Sign inBook a demo
Developers v1
⌘K

Website chatbot

Diagnose your installation.

Check public identifiers, exact origins, content security policies, publishing, assets and verification without exposing visitor information.

Updated 31 October 2026 · 6 min read

Understand the public integration.

A public key is safe in HTML. API keys, management tokens and verification secrets are not. Register exact HTTPS origins; https://example.com and https://www.example.com are different. Anonymous widget sessions cannot access patient/account records or perform protected writes. Use the secure portal for those requests.

Content Security Policy.

Allow the API origin generated by CRM in script-src and connect-src, and widget images/fonts in img-src and font-src. The shared renderer injects styles; provide your per-response CSP nonce on the script tag and authorize that nonce in style-src. The loader forwards its nonce to widget-created styles and the optional verification script. A site with no nonce must allow the generated widget styles under its own policy. Do not copy another request’s nonce.

Nonce-aware embed
<script nonce="YOUR_PER_RESPONSE_NONCE" async src="https://crm-api.peopletide.com/api/v1/public/web-forms/chatbot.js" data-public-key="YOUR_PUBLIC_KEY"></script>

When Turnstile verification is selected, also permit https://challenges.cloudflare.com in script-src, frame-src and connect-src as required by your policy. Built-in verification does not load Cloudflare. Configure only the providers your chatbot uses.

Common issues.

  1. 01

    No launcher

    Check the public key, registered Origin, enabled state, active provisioning, CRM device/page rules, network errors, CSP and blockers. A closed conversation is different from a hidden widget.

  2. 02

    Style did not change

    Publish the draft, choose it as default or pass its Style ID, then reload or call update(). Check for runtime placement overrides. No website rebuild is needed.

  3. 03

    Wrong brand or STYLE_UNAVAILABLE

    Use a published style from the same chatbot. The widget falls back to its published default if the requested style is unavailable.

  4. 04

    Import or images fail

    Confirm the website is publicly reachable over HTTPS. Import does not run JavaScript. Use manual uploads when necessary; branding storage must be configured by the CRM operator.

  5. 05

    AI cannot reply

    Confirm the selected workflow is published and supports website conversations. The widget offers consent-based enquiry capture for staff follow-up.

  6. 06

    Enquiry accepted but no lead

    Publish a matching Chatbot contact submitted workflow with Create / update lead. Check Captured enquiries and its dispatch status.

  7. 07

    Network interruption

    Use the widget’s retry controls. Contact retries preserve the submission identifier; avoid custom submission code or repeated clicks.

  8. 08

    Widget appears on an excluded route

    Call update() after framework navigation. A path rule also excludes its child pages. Keep the installation in a stable layout.

Report a reproducible issue.

Include the website origin and path, public chatbot/style identifiers, browser, configuration version and error code. Do not include visitor messages, contact details or access tokens.