Connect your website, channels, AI provider, and backend

Krisp connects your storefront, messaging channels, AI model provider, and order backend into one shared inbox. Every channel token and AI key you connect is verified with its service before saving and stored encrypted with AES-256-GCM.

Every workspace in Krisp has a unique Workspace Slug (for example acme-shop) and an explicit Website Allowlist. Even if someone copies your embed tag onto another site, both the loader and the browser’s Content-Security-Policy: frame-ancestors header refuse to open the widget outside the domains you list.

The slug is made from the workspace name. A name that would take a reserved address - Krisp’s own words and route names, mailbox names such as postmaster, or a well-known brand - gets a numbered slug (a workspace named Support gets support-1), as a name already taken does.

1. Add your domain

   Open Settings → Setup and enter your domain (such as yourstore.com). www. is included automatically; *.yourstore.com covers all subdomains; localhost:3000 works for local development.

2. Copy your embed tag

   Your personalized <script> tag in Settings → Setup already contains your workspace slug. Paste it before the closing </body> tag of your site.

3. Verify live

   Open your website in a browser tab. The Setup page in Krisp polls every few seconds and turns green automatically the moment the script runs on your site.

Paste the snippet below into your website’s layout template right before the closing </body> tag. Replace YOUR_WORKSPACE_SLUG with the slug shown in Settings → Setup:

<!-- Krisp Live Chat Widget -->
<script
  src="https://krisp.chat/api/widget/YOUR_WORKSPACE_SLUG/embed.js"
  async>
</script>

Optional script attributes

By default, the launcher button uses the accent color, workspace logo, and launcher label configured in Settings → Widget. The workspace logo is part of the Starter plan and above; on the Free plan the button shows the Krisp mark. You can override the button placement, accent color or logo on specific pages using data-* attributes on the script tag:

<script
  src="https://krisp.chat/api/widget/YOUR_WORKSPACE_SLUG/embed.js"
  data-position="left"
  data-accent="#4f46e5"
  async>
</script>

• Lazy session creation: The iframe and visitor session are only created when a visitor clicks to open the chat, keeping page load fast. Once a visitor has a conversation, the chat loads out of sight on every page of your site, so your replies reach them and are counted on the chat button.
• 30-day session persistence: Returning visitors automatically resume their conversation thread for up to 30 days.
• Rich media & Help tab: Visitors can search published knowledge-base articles, attach JPG/PNG images (up to 10 MB) and MP4/WebM videos (up to 50 MB), and rate the conversation when resolved.
• Recovers by itself: If the chat server cannot be reached, the widget retries on its own, opens from the copy of its settings kept in the browser, and checks for new messages every few seconds while live updates are blocked by a proxy or firewall. Only the server’s own refusal - an unknown or suspended workspace, a blocked visitor - stops the retries.

Select your storefront or framework below for step-by-step installation instructions:

import Script from 'next/script';

export default function RootLayout({ children }) {
  return (
    <html lang="en">
      <body>
        {children}
        <Script
          src="https://krisp.chat/api/widget/YOUR_WORKSPACE_SLUG/embed.js"
          strategy="afterInteractive"
        />
      </body>
    </html>
  );
}

Even if you do not have a website—or want a direct support link for email signatures, social bios, receipts, or QR codes—every workspace comes with a standalone hosted chat page:

https://krisp.chat/chat/YOUR_WORKSPACE_SLUG

Mapping your own subdomain (e.g. chat.yourstore.com)

On Starter (1 domain), Growth (3 domains), and Scale (10 domains) plans, you can serve the hosted chat page on your own domain:

• Step 1: In Settings → Setup under Without a website, open Your chat page, choose Add domain and enter your subdomain (such as chat.yourstore.com).
• Step 2: Add a DNS CNAME record pointing your subdomain to Krisp’s host. The TXT record shown in the dashboard can prove the domain instead, but only the CNAME brings visitors to the chat.
• Step 3: Click Check DNS. Once verified, Krisp serves your workspace’s chat page at https://chat.yourstore.com/.
• Isolated security boundary: Custom customer domains serve only the visitor chat page and widget endpoints—never the operator dashboard, login routes, or session cookies.
• Kept out of search, open to reports: The hosted chat page - at /chat/YOUR_WORKSPACE_SLUG or on your own domain - and the widget frame answer X-Robots-Tag: noindex, and the chat page carries a Report this page link that opens an email to Krisp naming the page.

Connect your external messaging channels so every customer conversation lands in the same shared inbox, runs through the same AI autopilot and automations, and replies back through the channel the customer used.

In Settings → Integrations, each workspace chooses how AI replies, operator drafts, and message rewrites are powered:

Krisp includes a deterministic automation engine and 11 built-in plugins that run in-process with zero external setup required:

• 11 Built-in Plugins: Sentiment Radar, Thread Summariser, Reply Copilot, Knowledge Gap Finder, Intent Tagger, Lead Scorer, Canned Macros, CSAT Survey and Calendly Booking, plus Shopify Orders and Stripe Billing connectors that spot order numbers and billing questions in a message (no call is made to Shopify or Stripe yet). Free installs up to 3, Starter 10, Growth and Scale any number.
• Plugin Chains: Chain multiple plugins together to execute sequentially on every visitor message and inspect every execution in the Run Log.
• Visual Automation Builder: Ten trigger kinds - keywords, intent, sentiment, priority, channel, first message, inside or outside opening hours, low classifier confidence, or a catch-all; chain knowledge-base lookups with conditional branching, replies, tags, teammate assignment, escalation, or resolution; and dry-run against sample messages before turning them on.
• Blueprints: Eleven ready-made flows in six packs. Free gets the starter pack, Starter adds e-commerce, and Growth and Scale get all of them.

Order lookup lets customers collect order credentials, license keys, or fulfillment details in the website chat—or on WhatsApp, Instagram, Messenger, Telegram and email, where they reply “credentials” or “agent” instead of tapping a button—without ever uploading your orders database to Krisp. When a customer types an order ID matching your regex pattern (default ORD-12345; presets include Shopify, WooCommerce and UUIDs) and confirms the email address they used at checkout, Krisp sends a signed POST request to your HTTPS endpoint. A customer who mentions an order without its ID is asked for it first.

Order lookup has its own switch and answers whether the AI chatbot is on or off, but never in a conversation your team is handling: one assigned to a teammate or in Pending, or one a teammate has replied in - that one until it is resolved. In production your endpoint’s name is resolved at every request and the request goes only to the public addresses that were checked, within 8 seconds for the whole exchange. A custom order-ID pattern is timed before it is saved and runs under a time limit, and the signing secret is stored encrypted.

Request headers sent by Krisp

Request body & expected JSON responses

// 1. Request body sent by Krisp:
{
  "type": "order.lookup",
  "test": false,
  "deliveryId": "5b0c6f0e-6a64-4c3e-9a0e-2f0d3f6f4b1a",
  "lookupId": "c1a2b3d4-0000-4000-8000-000000000001",
  "orderId": "ORD-12345",
  "email": "jane@example.com",
  "workspace": { "id": "ws_...", "slug": "your-shop" },
  "conversationId": "e7f8a9b0-...",
  "channel": "website",  // or "whatsapp", "instagram", "facebook", "telegram", "email"
  "visitor": { "id": "...", "externalId": "cust_42", "email": "jane@example.com" },
  "sentAt": "2026-10-15T10:00:00.000Z"
}

// 2A. Response when order + email match and credentials are ready (HTTP 200):
{
  "status": "verified",
  "order": { "id": "ORD-12345", "product": "Pro Annual License" },
  "credentials": [
    { "label": "License Key", "value": "KRISP-XXXX-YYYY-ZZZZ" },
    { "label": "Download URL", "value": "https://downloads.yourstore.com/pro" }
  ],
  "note": "Keep your license key private."
}

// 2B. Response when order is paid but still provisioning (HTTP 200):
{
  "status": "not_ready",
  "message": "Your order is still being prepared. Please check back in 10 minutes."
}

// 2C. Response when order ID or email does not match (HTTP 200):
{
  "status": "not_found"
}

Node.js (Express) signature verification example

import express from 'express';
import crypto from 'node:crypto';

const SECRET = process.env.KRISP_ORDER_LOOKUP_SECRET; // olsec_... from Settings -> Order lookup
const app = express();

app.post('/krisp/order-lookup', express.raw({ type: 'application/json', limit: '64kb' }), async (req, res) => {
  const timestamp = req.get('X-Krisp-Timestamp') ?? '';
  const signature = req.get('X-Krisp-Signature') ?? '';
  const raw = req.body.toString('utf8');

  if (!/^\d+$/.test(timestamp) || Math.abs(Date.now() / 1000 - Number(timestamp)) > 300) {
    return res.status(401).json({ error: 'stale request' });
  }
  const expected = 'v1=' + crypto.createHmac('sha256', SECRET).update(`${timestamp}.${raw}`).digest('hex');
  const a = Buffer.from(signature);
  const b = Buffer.from(expected);
  if (a.length !== b.length || !crypto.timingSafeEqual(a, b)) {
    return res.status(401).json({ error: 'invalid signature' });
  }

  const { orderId, email, test } = JSON.parse(raw);
  const order = await findOrderByNumber(orderId);
  if (!order || order.email.toLowerCase() !== email.toLowerCase()) {
    return res.json({ status: 'not_found' });
  }
  if (!order.ready) {
    return res.json({ status: 'not_ready', message: 'Your order is being prepared.' });
  }
  return res.json({
    status: 'verified',
    order: { id: order.id, product: order.productName },
    credentials: [{ label: 'License Key', value: order.licenseKey }],
  });
});

To integrate your backend directly with Krisp—for example to read conversations and messages, change a conversation’s state, assignee or tags, update a contact, or read AI usage—create a scoped API key in Settings → API keys.

1. Create a key

   Open Settings → API keys, give the key a label (such as Order sync), and choose its permissions: Read (GET requests), Write (create and update resources), or both.

2. Copy it once

   The full key is shown only once at creation. Krisp stores a peppered SHA-256 hash of the key and never logs or displays it again.

3. Send x-krisp-key

   Pass the key in the x-krisp-key HTTP header on every request; an Authorization header is not read. Owner/admin settings (billing, team, budgets, and keys) and anything a teammate does in person - sending a message, writing an article, importing data - never accept an API key.

# List unresolved conversations in your workspace
curl -sS \
  -H "x-krisp-key: YOUR_API_KEY" \
  "https://krisp.chat/api/conversations?state=unresolved&limit=25"

# Mark a conversation resolved (needs the Write permission)
curl -sS -X PATCH \
  -H "x-krisp-key: YOUR_API_KEY" \
  -H "content-type: application/json" \
  -d '{"state":"resolved"}' \
  "https://krisp.chat/api/conversations/CONVERSATION_ID"

# Replace its tags
curl -sS -X PUT \
  -H "x-krisp-key: YOUR_API_KEY" \
  -H "content-type: application/json" \
  -d '{"tags":["refund","vip"]}' \
  "https://krisp.chat/api/conversations/CONVERSATION_ID/tags"

All API endpoints accept and return JSON. Errors follow a consistent envelope: { "error": { "code": "E_...", "message": "..." } }.