Your assistant right on your website, with each customer's own access

In this article

Your customer logs into your portal and wants to know where their order is. The usual support chat answers with FAQs or hands them to a person. The Grostify Connect web chat answers with their data: their orders, their invoices, their balance, the tracking of their shipment. And it does it with the customer's own access, not with a key that belongs to your company.

One line on your website

You paste a <script> tag on the pages where you want the chat:

<script src="https://connect.grostify.com/widget/v1.js" data-tenant="acme" async></script>

You don't touch your backend. The script draws a round button in the bottom right corner and the chat opens in a panel when the customer clicks it. It reads nothing from your page and stores nothing of its own. It only opens on the websites you list in the panel, and all of them must sit under your verified domain.

The customer connects their account once

The first time, the chat shows a Connect my account button:

1. A Connect window opens that shows your verified domain and says the access is read only.
2. The customer signs in with your usual login, or pastes their personal API key if your API works with keys. Connect never sees their password.
3. The window closes on its own and the chat is ready, with "Signed in as" and a Disconnect button always in view.

The session lasts 7 days without use and 30 days at most. For shared computers, your website calls GrostifyConnect.logout() in its own sign out and the chat signs out with it.

It answers with the customer's own access

This is the difference that matters. The best known support chats identify the customer with a token your backend signs, and then call your API with a credential that belongs to your company. Intercom, for example, documents its connectors with a company token and leaves it to your API to check that each customer only sees their own data¹.

That leaves a key that can read every customer's data stored at the chat provider. If your API ever gets the customer wrong, so does the chat.

In Connect that key does not exist. Every call to your API carries the credential of the customer who asks, the same one they get when they sign in with your login. The assistant only sees what that customer can already see in your system.

What it does and what it doesn't

• Read only. It uses the tools you enabled on the Web channel and never changes anything.
• Links only to your domain. A link in an answer that doesn't point to your verified domain is removed before it is shown.
• Clear limits. 50 questions a day per customer and one at a time per conversation.
• Private by default. Conversation text is deleted after 30 days. Your company sees metrics, not text: number of questions and active sessions, which you can revoke.
• Your website never sees the session. It lives in a partitioned cookie that your page's JavaScript cannot read, and Connect only stores its hash.

How to turn it on

In the dashboard, open your integration and:

1. Enable the tools you want to offer on the Web channel.
2. In the Web chat step, add your website origins, pick the model and turn the chat on.
3. Copy the snippet and paste it on your website.

All the details are in the web chat documentation. Connect is invitation only for now: if you want to try it with your API, request access from the home page.

Notes

1. Intercom, "Designing and using your APIs with Data connectors": https://www.intercom.com/help/en/articles/10576235-designing-and-using-your-apis-with-data-connectors ↩

• #web-chat
• #assistant
• #security