widget.js and the assistant update continuously and are not listed here: you get them without upgrading anything. See Versioning.
October 26, 2026
@concatflow/embed and @concatflow/node 0.2.0
Concatflow moved to concatflow.com. The default base of @concatflow/embed and the default baseUrl of @concatflow/node are now https://app.concatflow.com (they were https://dash.usecubit.io). The API is at https://api.concatflow.com.The old hostnames will redirect to the new ones, but a redirect does not work for these packages: the widget checks the origin of the iframe it talks to, and a redirected POST loses its body. Upgrade before the old hostnames start redirecting, or pass the new host explicitly as base or baseUrl. If you already set base or baseUrl, point it at the new host.If your Content-Security-Policy lists the old host, replace it with https://app.concatflow.com in frame-src and script-src. See Content-Security-Policy.October 23, 2026
@concatflow/embed and @concatflow/node 0.1.1
Documentation only. No code change: upgrading is optional.- The
@concatflow/embedREADME shows the script tag for pages without a build step. - Both READMEs say where to find each identifier in the dashboard.
October 23, 2026
First release
@concatflow/embed
loadConcatflow()loads the hostedwidget.jsonce and resolves to theConcatflowglobal.Concatflow.init()opens the assistant on either door, withsiteTokenorsession. Options:launcher,target,base,theme,accent,placeholderandonSessionExpired.- The instance:
setSession,open,closeanddestroy. <ConcatflowAssistant>for React, from@concatflow/embed/react.PROTOCOL_VERSIONis1.
@concatflow/node
new Concatflow({ apiKey }). It refuses to run in a browser.sessions.createopens a per-user session and returns{ token, expiresAt }.conversations.listandconversations.erase.ConcatflowErroron any non-2xx answer, withstatus,codeandbody.
HTTP API
/api/v1/: open a session, read a conversation, erase a conversation.