Embed MatnBot without exposing keys or secrets
The widget is the recommended website integration. Public chat session endpoints use a short-scope session token issued once when the session is created.
Website widget
Place the script before the closing body tag or inside head. It waits for the document automatically and reads color, position, and visitor-field settings from the bot configuration.
<script
src="https://matnbot.com/widget/embed.js"
data-bot="your-bot-slug">
</script>Public chat session API
Keep sessionToken in page memory and send it in X-Chat-Session-Token. Never place it in a URL, logs, or persistent storage.
1. Create a session
POST https://api.matnbot.com/api/chat/sessions
Content-Type: application/json
{
"botSlug": "your-bot-slug",
"visitorName": "Optional name",
"visitorEmail": "name@example.com",
"visitorPhone": "+966500000000",
"pageUrl": "https://example.com/services"
}2. Send a message and receive SSE
POST https://api.matnbot.com/api/chat/sessions/{sessionId}/messages
Content-Type: application/json
X-Chat-Session-Token: {sessionToken}
{
"content": "Your message"
}Management APIs
Workspace, bot, billing, and channel management are not currently exposed as a customer API-key product. Use the authenticated dashboard. Contact sales for a scoped server integration and authentication design.
Security boundaries
- Use HTTPS only.
- Never place OpenAI, Meta, or JWT secrets in browser code.
- Never share a sessionToken across visitors or sessions.
- Use only the public data-bot slug, not internal identifiers.
- Configure trusted and blocked domains in bot settings.
MatnBot API
api.matnbot.com