Getting started with web channel

Overview

The Moveo web channel enables you to add AI-powered conversations directly to your website. This channel provides a customizable chat interface that can be styled to match your brand and configured to meet your specific requirements.

note

By default, a conversation in the web channel stays active for one hour if the user does not close the window. The web channel does not load if the user agent (browser) is a bot.

Quick start

To add the web channel to your website:

1. Go to Integrations in your Moveo account
2. Select your environment
3. Click Connect below the Web integration
4. Copy the generated snippet and add it before the </body> tag:

<script src="https://web.moveo.ai/web-client.min.js"></script>
<script>
  MoveoAI.init({
    integrationId: "YOUR-INTEGRATION-ID",
    version: "v2",
  })
    .then((instance) => console.log("connected"))
    .catch((error) => console.error(error));
</script>

5. Add your domain to the trusted domains list
6. Set the web channel state to Active

That's it! Your web channel is now ready to receive messages.

Installation options

Standard installation

The standard installation loads the web channel on every page:

<script src="https://web.moveo.ai/web-client.min.js"></script>
<script>
  MoveoAI.init({
    integrationId: "YOUR-INTEGRATION-ID",
    version: "v2",
  })
    .then((instance) => console.log("connected"))
    .catch((error) => console.error(error));
</script>

Embed mode

Render the chat within your page content instead of as a floating widget:

<div id="chat-container"></div>
<script src="https://web.moveo.ai/web-client.min.js"></script>
<script>
  MoveoAI.init({
    integrationId: "YOUR-INTEGRATION-ID",
    element: document.getElementById("chat-container"),
    version: "v2",
  })
    .then((instance) => console.log("embedded chat connected"))
    .catch((error) => console.error(error));
</script>

Delayed initialization

Wait for page load or user interaction before initializing:

<script src="https://web.moveo.ai/web-client.min.js"></script>
<script>
  window.addEventListener("DOMContentLoaded", function () {
    MoveoAI.init({
      integrationId: "YOUR-INTEGRATION-ID",
      version: "v2",
    })
      .then((instance) => console.log("connected"))
      .catch((error) => console.error(error));
  });
</script>

User authentication

Secure your web channel and authenticate users to ensure messages come from verified customers only.

Why authenticate?

Authentication provides:

• Security: Verify that messages come from your actual customers
• Personalization: Pass user data securely to provide tailored responses
• Privacy: Encrypt sensitive information end-to-end

Basic authentication setup

1. Generate RSA keys:

# Private key (keep secure on your server)
openssl genrsa -out private.pem 2048
# Public key (add to Moveo)
openssl rsa -in private.pem -outform PEM -pubout -out public.pem

2. Add public key to Moveo:

   • Go to Integrations → Web → Advanced security settings
   • Enable Activate end-to-end encryption
   • Paste your public key

3. Generate JWT on your server:

Node.js

const jwt = require('jsonwebtoken');

function generateToken(userId) {
  const payload = {
    sub: userId, // Required: unique user ID
    iss: 'yourdomain.com', // Required: issuer
  };

  return jwt.sign(payload, process.env.PRIVATE_RSA_KEY, {
    algorithm: 'RS256',
    expiresIn: '5m', // Max 5 minutes
  });
}

Go

import (
  "crypto/x509"
  "encoding/pem"
  "github.com/golang-jwt/jwt"
  "time"
)

func generateToken(userId string) (string, error) {
  token := jwt.NewWithClaims(jwt.SigningMethodRS256, jwt.MapClaims{
    "sub": userId,           // Required
    "iss": "yourdomain.com", // Required
    "exp": time.Now().Add(5 * time.Minute).Unix(),
  })

  // Sign with private key
  privateKey := loadPrivateKey()
  return token.SignedString(privateKey)
}

4. Initialize with authentication:

<script>
  MoveoAI.init({
    integrationId: "YOUR-INTEGRATION-ID",
    identityToken: "JWT_FROM_YOUR_SERVER",
    version: "v2",
  })
    .then((instance) => console.log("authenticated"))
    .catch((error) => console.error(error));
</script>

Passing encrypted user data

To securely pass sensitive user information (e.g., account details, VIP status):

1. Get Moveo's public key from your web integration settings
2. Encrypt context with AES-256
3. Encrypt AES key with RSA
4. Include in JWT:

Node.js

const crypto = require("crypto");
const jwt = require("jsonwebtoken");
const RSA = require("node-rsa");

function generateSecureToken(userId, userContext) {
  // Generate AES key and IV
  const aesKey = crypto.randomBytes(32);
  const iv = crypto.randomBytes(16);

  // Encrypt context with AES
  const cipher = crypto.createCipheriv("aes-256-cbc", aesKey, iv);
  let encrypted = cipher.update(JSON.stringify(userContext), "utf8", "base64");
  encrypted += cipher.final("base64");

  // Encrypt AES key with Moveo's RSA public key
  const rsaKey = new RSA(process.env.MOVEO_PUBLIC_KEY);
  const encryptedKey = rsaKey.encrypt(aesKey, "base64");
  const encryptedIV = rsaKey.encrypt(iv, "base64");

  // Create JWT with encrypted data
  const payload = {
    sub: userId,
    iss: "yourdomain.com",
    context: encrypted, // AES encrypted context
    encryption_key: encryptedKey, // RSA encrypted AES key
    init_vector: encryptedIV, // RSA encrypted IV
  };

  return jwt.sign(payload, process.env.PRIVATE_RSA_KEY, {
    algorithm: "RS256",
    expiresIn: "5m",
  });
}

// Usage
const userContext = {
  user: {
    email: "user@example.com",
    is_vip: true,
    account_tier: "premium",
  },
  contract_id: "12345",
  credit_limit: 10000,
};

const token = generateSecureToken("user-123", userContext);

The encrypted context is available in your AI Agent for personalization but never sent back to the client, ensuring sensitive data remains secure.

Authentication flow

Security best practices

1. Keep private keys secure - Never expose them in client-side code
2. Use short expiration times - Max 5 minutes for JWT tokens
3. Validate on server - Always generate tokens server-side
4. Encrypt sensitive data - Use AES encryption for context data
5. Trusted domains - Only allow your domains in settings
6. HTTPS only - Always use secure connections

Mobile app integration

To use the web channel in a mobile application:

1. Host the web channel on a webpage accessible by URL
2. Embed the webpage using a WebView or iframe:

<!-- Host this page on your server -->
<!DOCTYPE html>
<html>
  <head>
    <meta name="viewport" content="width=device-width, initial-scale=1" />
  </head>
  <body>
    <script src="https://web.moveo.ai/web-client.min.js"></script>
    <script>
      MoveoAI.init({
        integrationId: "YOUR-INTEGRATION-ID",
        // Pass authentication from mobile app if needed
        identityToken: window.AUTH_TOKEN,
        version: "v2",
      })
        .then((instance) => {
          // Expose instance to mobile app if needed
          window.moveoInstance = instance;
        })
        .catch((error) => console.error(error));
    </script>
  </body>
</html>

Then embed this page in your mobile app's WebView component.

Next steps

• Configure appearance and behavior
• Use methods and events
• Troubleshoot common issues