AI agents

How coding agents should install CanWeChat on a customer site using the public Widget API and webhooks — not internal dashboard APIs.

Goal

Take a site from zero to “visitor message lands where the team works” using the public install surface: script tag, Widget JS API, domain lock (via the dashboard UI), and optional signed webhooks to the customer’s backend.

Read first

Fetch https://canwechat.dev/llms.txt, then /docs/install, /docs/widget, /docs/webhooks, and /openapi.json. Product truths: one website per workspace, one active reply destination, 3-day trial then $19/month, no fake SLA copy in the widget.

Install checklist

1) Human signs in at /login (email OTP) and copies the script from /app/install. 2) Agent adds the script before </body> or in the app root layout. 3) Human locks allowed domains in Settings. 4) Agent calls CanWeChat.identify after app auth when available. 5) Human sends a test message and picks inbox, Slack, Discord, or Telegram in the dashboard.

html

<script
  async
  src="https://canwechat.dev/api/widget.js"
  data-site="pk_live_YOUR_KEY"
></script>

Identify visitors

After the host app knows the signed-in user, call CanWeChat.identify so humans in the inbox see a stable person. The Widget API buffers calls until the script boots.

javascript

CanWeChat.identify({
  userId: user.id,
  email: user.email,
  name: user.name,
});

Reply channels

Slack, Discord, and Telegram are configured in /app/integrations by a human (or a trusted ops flow). Do not paste bot tokens into client bundles, committed env files that ship to the browser, or agent chat logs.

Webhooks

For CRMs and the customer’s own automation, enable the signed webhook relay in the dashboard. Verify HMAC-SHA256 over `${timestamp}.${rawBody}` and treat event ids as idempotent. See /docs/webhooks. Agents should implement the receiver — not call CanWeChat admin APIs to manage the relay.

Out of scope

Do not call or document dashboard session routes (/api/v1/me, /conversations, /integrations, /webhook-relay admin, billing, team, …) as an integration API. Do not scrape /app HTML for contracts. Do not invent OAuth flows the product does not expose. Do not claim measured first-response SLAs for CanWeChat.

MCP

MCP servers for CanWeChat should help with public install and webhook receivers only. See /docs/mcp. Do not wrap internal dashboard APIs.