An API. Not a dashboard locked behind a login.

API surface

Four endpoints. One widget. One webhook channel.

Widget integration

Two lines of HTML.

The widget is a vanilla Web Component, ~22KB gzip, served from Cloudflare's edge. Drop it on any page; theme it via the eight CSS custom properties documented on /product/widget.

<script src="https://widget.flowchat.com/v1.js" defer></script>
<flowchat-widget
  data-key="kbk_live_xxxxxxxx"
  data-source="docs"
  data-locale="en"
></flowchat-widget>

SSE event contract

The chat stream emits structured events.

Every retrieval, generation, citation, and verification step is a named event on the SSE stream. The live demo on the homepage subscribes to the same stream and animates the Source Trail panel from it.

event: retrieval.started
data: {"query":"How do you handle hallucinations?"}

event: retrieval.reranked
data: {"chunks":[{"id":"chk_grnd1","url":"/product/ground","score":0.94}, ...]}

event: generation.token
data: {"text":"Three"}

event: generation.cited
data: {"ref":1,"chunkId":"chk_grnd1"}

event: nli.verified
data: {"ref":1,"ok":true}

event: stream.done
data: {"refusal":false}

Webhook signatures

HMAC-SHA256, timestamp-prefixed.

Verify webhook authenticity by computing HMAC-SHA256(secret, timestamp + "." + body) and comparing it to the X-FlowChat-Signature header in constant time. Reject events older than 5 minutes to prevent replay.

// Node example
import { createHmac, timingSafeEqual } from "node:crypto";

function verify(body, headers, secret) {
  const ts = headers["x-flowchat-timestamp"];
  const sig = headers["x-flowchat-signature"];
  const expected = createHmac("sha256", secret)
    .update(`${ts}.${body}`)
    .digest("hex");
  return timingSafeEqual(
    Buffer.from(sig, "hex"),
    Buffer.from(expected, "hex"),
  ) && Date.now() - Number(ts) * 1000 < 5 * 60 * 1000;
}