Widget Overview
Current availability of Keva's origin-bound support widget
The Keva widget has an origin-bound installation and short-lived session model.
The bundle is built from source on every deploy and served at
<your-keva-origin>/widget/v1/keva-widget.js, and Settings > Widget shows
the install snippet — see
Widget Installation Boundary. The required database
migration and customer journey are not ready for customer use yet.
Do not embed a reusable API credential in page markup. Current widget source accepts a non-secret public installation ID, exchanges it for an in-memory session, and sends that session only in authorization headers.
How the widget is designed to work
- A dashboard installation belongs to one tenant, one selected workspace, and an exact HTTPS-origin allowlist.
- The browser SDK accepts
publicId, not a reusable secret. - A successful origin check can mint a 15-minute session. The SDK does not yet renew an expired session or resume its bound conversation.
- Chat, form, follow-up, media, and streaming routes share the session authority locally.
- Structured-form and follow-up chat media follows the presign, confirm, and same-session claim path locally. Chat uploads are sent as bounded attachment IDs after confirmation; inline base64 is rejected. This has been checked only in local testing, not on a live site.
- Redis-backed throttles currently allow requests when Redis is unavailable; abuse and paid-provider containment therefore remain unresolved.
Availability
Settings can reserve and revoke public installation identities only after the widget schema is applied. Keva intentionally provides no copyable install snippet while the artifact-publication, cache/version, and rollback contract is undefined.
Local tests and a successful application build do not make the widget available. Installation, session continuation, message delivery, attachment storage, and AI response behavior are not available for customer use yet.