Loading
Understand how your Bot ID works as the widget's credential, and how the REST API key differs.
EquilAI has two credentials for two jobs. The website widget identifies itself with your public Bot ID, which lives in the snippet and needs no token. The server-side REST API uses a secret API key you create in the dashboard, and that one belongs on your server only.
How it works
Every bot has a unique UUID assigned at creation time. This ID:
Your Bot ID (example)
a1b2c3d4-e5f6-7890-abcd-ef1234567890Find your real Bot ID in Dashboard → Deployment.
Widget authentication
For the widget embed, authentication is implicit: your Bot ID is part of the script URL. No extra configuration is needed, and the widget handles every call it makes from there on its own.
<!-- Your Bot ID is embedded in the script URL -->
<script data-cfasync="false">
(function () {
var s = document.createElement("script");
s.src = "https://equilai.ai/api/widget/script/YOUR_BOT_ID.js";
s.async = true;
document.head.appendChild(s);
})();
</script>REST API authentication
The server-side REST API uses a secret API key instead of the Bot ID. Create one in Dashboard → API, then send it in the JSON body as apiKey. Unlike the Bot ID, this key is a secret: keep it on your server and never expose it in client-side code. See the API reference →
POST /api/chat/start
{ "apiKey": "YOUR_API_KEY" }Security
Because the Bot ID is public, the widget's requests are also validated by origin domain. You control which sites may embed your bot in Dashboard → Bot → Allowed Domains. The REST API is not domain-restricted; its secret key is the credential.
What this means in practice:
403Ready to start integrating? See the REST API →