Tikivio1. Minimal setup
Under Settings › Embeddable widget (/o/<your-organisation>/parametres/widget), turn the widget on, declare your website’s allowed origins, then paste the snippet before </body>:
<script async src="https://app.tikivio.com/widget/tikivio.js" data-tikivio="<public_id>"></script>The public_id (32 hexadecimal characters) is public, not a secret: it gives access to nothing without address verification or a signed token.
Optional attributes
| Attribute | Values | Purpose |
|---|---|---|
data-tikivio-lang | fr | en | forces the language of the widget and button (otherwise the browser language, then the widget’s default language) |
data-tikivio-position | right | left | corner of the floating button |
data-tikivio-label | text | button label (“Help & support” by default) |
data-tikivio-color | #rrggbb | colour of the floating button |
data-tikivio-open | auto | opens the window on page load |
data-tikivio-token | signed token | identification by your website (see below) |
JavaScript functions available once the script has loaded: Tikivio.open(), Tikivio.close(), Tikivio.toggle(), Tikivio.setHostToken(token), Tikivio.setLanguage('fr'|'en').
2. Identification with an e-mail code
The visitor enters their address and receives a 6-digit code, valid for 10 minutes (5 attempts). Limits: 3 codes per address within 15 minutes and 20 code requests per IP address within 1 hour. A session lasts 30 minutes and can be renewed for up to 12 hours; no cookie is used and no account is created.
3. Identification by your website (signed token)
If your website already knows the user, your server signs a token with the widget secret (shown only once when generated; never put it in a page or a browser script). Format:
base64url(email|name|exp|nonce) . "." . hex(HMAC-SHA256(secret, "email|name|exp|nonce"))exp: Unix timestamp, at most 15 minutes after issue;nonce: 8 to 64 characters[A-Za-z0-9_-], unique: each token is accepted only once;- pass it through
data-tikivio-tokenorTikivio.setHostToken(token), never in a URL.
$payload = "$email|$name|$exp|$nonce";
$token = rtrim(strtr(base64_encode($payload), '+/', '-_'), '=') . '.' . hash_hmac('sha256', $payload, $secret);Regenerating the secret immediately invalidates tokens in circulation.
4. Allowed origins
Declare each origin exactly, such as https://www.example.com (scheme, host and optional port; no path, no wildcard; 20 origins at most). A page outside the list cannot display the widget.
5. What the widget does
- Lists the visitor’s requests with their real state; a “Refresh” button (no automatic polling).
- New request with attachments: up to 10 files, 25 MB per file and 40 MB per message, within your plan’s storage limit.
- Your team’s public replies; never an internal note.
- Dated messages: it is not a live chat. Each reply is also sent by e-mail once your organisation has connected a sending mailbox.