Skip to main content

​
Site token

The site token opens the public door. It sits in your page’s HTML, so anyone can read it. That is expected: it only reaches data you marked public, from origins you allowed.
  1. Open the assistant, then the Doors tab.
  2. Turn the public door on.
  3. Copy the snippet. The site-token attribute holds the token.
The site token alone does not protect anything. What limits the public door is its scope (public tables, shared rows), the allowed origins, and the rate and spending caps.

​
Assistant ID

Your server needs it to open sessions and to read or erase conversations.
  1. Open the assistant.
  2. Open the Integration tab. The server snippet carries the assistant ID.
It is also in the assistant’s URL: /assistants/<id>.

​
API key

The API key commits your workspace. Treat it like a password.
  1. Open Settings → Developers → API keys.
  2. Create a key. Only the workspace owner can.
  3. Copy it once, and store it in an environment variable on your server.
.env
Never put the API key in front-end code, a mobile app or a public repository. @concatflow/node refuses to run in a browser for that reason.

​
Partition dimensions

The per-user door also needs the partition keys of your assistant: the columns that say whose data a row is, such as customer_id. They are set when you sign the assistant’s isolation, in the Isolation tab. Your server must send exactly those keys when it opens a session. See Per-user door.