Skip to main content

Getting started with web channel

Overview​

The Moveo web channel enables you to add AI-powered conversations directly to your website. This channel provides a customizable chat interface that can be styled to match your brand and configured to meet your specific requirements.

note

By default, a conversation in the web channel stays active for one hour if the user does not close the window. The web channel does not load if the user agent (browser) is a bot.

Quick start​

To add the web channel to your website:

  1. Go to Integrations in your Moveo account
  2. Select your environment
  3. Click Connect below the Web integration
  4. Copy the generated snippet and add it before the </body> tag:
<script src="https://web.moveo.ai/web-client.min.js"></script>
<script>
  MoveoAI.init({
    integrationId: "YOUR-INTEGRATION-ID",
    version: "v2",
  })
    .then((instance) => console.log("connected"))
    .catch((error) => console.error(error));
</script>
  1. Add your domain to the trusted domains list
  2. Set the web channel state to Active

That's it! Your web channel is now ready to receive messages.

Installation options​

Standard installation​

The standard installation loads the web channel on every page:

<script src="https://web.moveo.ai/web-client.min.js"></script>
<script>
  MoveoAI.init({
    integrationId: "YOUR-INTEGRATION-ID",
    version: "v2",
  })
    .then((instance) => console.log("connected"))
    .catch((error) => console.error(error));
</script>

Embed mode​

Render the chat within your page content instead of as a floating widget:

<div id="chat-container"></div>
<script src="https://web.moveo.ai/web-client.min.js"></script>
<script>
  MoveoAI.init({
    integrationId: "YOUR-INTEGRATION-ID",
    element: document.getElementById("chat-container"),
    version: "v2",
  })
    .then((instance) => console.log("embedded chat connected"))
    .catch((error) => console.error(error));
</script>

Delayed initialization​

Wait for page load or user interaction before initializing:

<script src="https://web.moveo.ai/web-client.min.js"></script>
<script>
  window.addEventListener("DOMContentLoaded", function () {
    MoveoAI.init({
      integrationId: "YOUR-INTEGRATION-ID",
      version: "v2",
    })
      .then((instance) => console.log("connected"))
      .catch((error) => console.error(error));
  });
</script>

User authentication​

Secure your web channel and authenticate users to ensure messages come from verified customers only.

Why authenticate?​

Authentication provides:

  • Security: Verify that messages come from your actual customers
  • Personalization: Pass user data securely to provide tailored responses
  • Privacy: Encrypt sensitive information end-to-end

Basic authentication setup​

  1. Generate RSA keys:
# Private key (keep secure on your server)
openssl genrsa -out private.pem 2048
# Public key (add to Moveo)
openssl rsa -in private.pem -outform PEM -pubout -out public.pem

  1. Add public key to Moveo:

    • Go to Integrations → Web → Advanced security settings
    • Enable Activate end-to-end encryption
    • Paste your public key

  2. Generate JWT on your server:

const jwt = require('jsonwebtoken');

function generateToken(userId) {
  const payload = {
    sub: userId, // Required: unique user ID
    iss: 'yourdomain.com', // Required: issuer
  };

  return jwt.sign(payload, process.env.PRIVATE_RSA_KEY, {
    algorithm: 'RS256',
    expiresIn: '5m', // Max 5 minutes
  });
}
  1. Initialize with authentication:
<script>
  MoveoAI.init({
    integrationId: "YOUR-INTEGRATION-ID",
    identityToken: "JWT_FROM_YOUR_SERVER",
    version: "v2",
  })
    .then((instance) => console.log("authenticated"))
    .catch((error) => console.error(error));
</script>

Passing encrypted user data​

To securely pass sensitive user information (e.g., account details, VIP status):

  1. Get Moveo's public key from your web integration settings
  2. Encrypt context with AES-256
  3. Encrypt AES key with RSA
  4. Include in JWT:
Match the encryption scheme exactly

Moveo decrypts encryption_key and init_vector with RSA-OAEP (SHA-256), and the context with AES-256-CBC. Libraries that default to a different padding or hash produce tokens Moveo cannot decrypt. In particular, node-rsa defaults to OAEP with SHA-1, so always set the OAEP hash to SHA-256 (as shown below).

const crypto = require("crypto");
const jwt = require("jsonwebtoken");

function generateSecureToken(userId, userContext) {
  // Generate AES key and IV
  const aesKey = crypto.randomBytes(32);
  const iv = crypto.randomBytes(16);

  // Encrypt context with AES-256-CBC
  const cipher = crypto.createCipheriv("aes-256-cbc", aesKey, iv);
  let encrypted = cipher.update(JSON.stringify(userContext), "utf8", "base64");
  encrypted += cipher.final("base64");

  // Encrypt the AES key and IV with Moveo's RSA public key.
  // Moveo decrypts with RSA-OAEP / SHA-256, so the padding and hash must
  // match exactly or decryption fails server-side.
  const oaep = {
    key: process.env.MOVEO_PUBLIC_KEY,
    padding: crypto.constants.RSA_PKCS1_OAEP_PADDING,
    oaepHash: "sha256",
  };
  const encryptedKey = crypto.publicEncrypt(oaep, aesKey).toString("base64");
  const encryptedIV = crypto.publicEncrypt(oaep, iv).toString("base64");

  // Create JWT with encrypted data
  const payload = {
    sub: userId,
    iss: "yourdomain.com",
    context: encrypted, // AES encrypted context
    encryption_key: encryptedKey, // RSA encrypted AES key
    init_vector: encryptedIV, // RSA encrypted IV
  };

  return jwt.sign(payload, process.env.PRIVATE_RSA_KEY, {
    algorithm: "RS256",
    expiresIn: "5m",
  });
}

// Usage
const userContext = {
  user: {
    email: "user@example.com",
    is_vip: true,
    account_tier: "premium",
  },
  contract_id: "12345",
  credit_limit: 10000,
};

const token = generateSecureToken("user-123", userContext);

The encrypted context is available in your AI Agent for personalization but never sent back to the client, ensuring sensitive data remains secure.

Authentication flow​

Security best practices​

  1. Keep private keys secure - Never expose them in client-side code
  2. Use short expiration times - Max 5 minutes for JWT tokens
  3. Validate on server - Always generate tokens server-side
  4. Encrypt sensitive data - Use AES encryption for context data
  5. Trusted domains - Only allow your domains in settings
  6. HTTPS only - Always use secure connections

Mobile app integration​

To use the web channel in a mobile application:

  1. Host the web channel on a webpage accessible by URL
  2. Embed the webpage using a WebView or iframe:
<!-- Host this page on your server -->
<!DOCTYPE html>
<html>
  <head>
    <meta name="viewport" content="width=device-width, initial-scale=1" />
  </head>
  <body>
    <script src="https://web.moveo.ai/web-client.min.js"></script>
    <script>
      MoveoAI.init({
        integrationId: "YOUR-INTEGRATION-ID",
        // Pass authentication from mobile app if needed
        identityToken: window.AUTH_TOKEN,
        version: "v2",
      })
        .then((instance) => {
          // Expose instance to mobile app if needed
          window.moveoInstance = instance;
        })
        .catch((error) => console.error(error));
    </script>
  </body>
</html>

Then embed this page in your mobile app's WebView component.

Next steps​

Last updated on