Sourceform
DASign inGet started
Public embed guide

One script. A separate boundary.

The loader opens a white-label, sandboxed iframe from the widget origin. Your public key identifies a published deployment. The loader exchanges it from the customer page for a short-lived, origin-bound session and passes that token to the iframe once—never in a URL.

  1. 1

    Verify the website domain

    Add the exact origin in Bot Studio. Redirects and crawls to unapproved origins are rejected. Public origins use HTTPS and are frozen into the next published deployment.

    https://www.example.comAllowed origin
  2. 2

    Paste the loader

    Place it before the closing </body> tag or load it through your consent-aware tag manager. The loader creates the embed session using the browser’s customer-page Origin, then completes a one-time postMessagehandshake with the separate widget origin.

    <script
  src="https://cdn.sourceform.eu/embed/v1.js"
  data-bot="bot_pub_..."
  data-api="https://api.sourceform.eu"
  async>
</script>
  3. 3

    Allow the widget in your CSP

    If your site uses Content Security Policy, add the CDN to script-src, the widget origin to frame-src, and the API origin to connect-src.

    script-src https://cdn.sourceform.eu
frame-src https://widget.sourceform.eu
connect-src https://api.sourceform.eu
  4. 4

    Test the published release

    Open the launcher on desktop and mobile, verify keyboard focus, ask an answerable and an unanswerable question, then inspect the citation.

    • The “AI assistant” disclosure is visible
    • The widget becomes fullscreen on mobile
    • Escape and the close button return focus
    • Session tokens stay in memory and never appear in iframe URLs
    • Unsupported questions abstain without a citation