Install the embed snippet

Snippet shape

The console shows a ready-to-paste snippet. Conceptually it looks like:

<script src="https://embed.ismscopilot.com/loader.js"></script>
<script>
  IsmsCopilotEmbed.init({
    partnerId: "<your-partner-id>",
    publicKey: "<public-key-from-console>",
    // Advanced partner path instead of publicKey:
    // token: "<end-user JWT from your backend>",
    // optional: layout ("floating" | "inline"), language ("en"),
    // position ("right" | "left", floating only),
    // theme: { "--ic-accent": "#4D4CD7" }
  });
</script>

Always prefer the snippet the console generates. Field names (publicKey, partner id, theme keys) can evolve; if the docs example and the console disagree, the console wins.

Title / identity

Do not rely on a client title field to brand the bot. Header name and model self-ID come from the server (Assistant name in the console). See Assistant name and attribution.

Domains

For live visitor traffic, add the origins where the widget will load (your marketing site, app subdomain, etc.). Traffic from domains that are not allowlisted is rejected.

The install panel can still show the snippet before every domain is configured so you can prepare the change; production visitors need the allowlist.

Layouts: floating and inline

The loader supports two layouts:

• floating (default): a launcher bubble fixed to the corner of the page. position: "right" | "left" picks the corner.
• inline: the assistant mounts inside an element on your page (no launcher bubble). Requires target, either a CSS selector string or an HTMLElement that is attached to the page.

<div id="isms-embed" style="height: 480px"></div>
<script src="https://embed.ismscopilot.com/loader.js"></script>
<script>
  IsmsCopilotEmbed.init({
    partnerId: "<your-partner-id>",
    publicKey: "<public-key-from-console>",
    layout: "inline",
    target: "#isms-embed",
  });
</script>

Notes:

• position is only valid with floating; target is only valid with inline. Mixing them rejects the call with an error (see below).
• The inline iframe fills its host element with height: 100%, so the host needs a definite height (a fixed height, or a flex/grid track that stretches it); min-height alone is not enough. A zero-height host logs a console warning.
• IsmsCopilotEmbed.open() and close() toggle the floating panel and are no-ops in inline layout.

Lifecycle: destroy and re-init

One widget instance per page. Calling init() while an instance is live is rejected with ALREADY_INITIALIZED; call IsmsCopilotEmbed.destroy() first to tear down the iframe, launcher, timers, and session state, then init() again (useful in single-page apps on route changes).

Feature detection: IsmsCopilotEmbed.version is the loader version string and IsmsCopilotEmbed.capabilities is an object (currently { inline: true, destroy: true, themeBoot: true }) you can check before using newer options.

Error handling

init() accepts an optional onError callback which receives { code, message, detail }. Errors are also logged to the browser console. Codes:

Theming

Optional CSS variables let the widget match your brand. Allowlisted keys: --ic-bg, --ic-fg, --ic-muted, --ic-border, --ic-accent, --ic-accent-fg, --ic-user-bubble, --ic-assistant-bubble, --ic-header-bg, --ic-composer-bg, --ic-radius, --ic-font, --ic-shadow. Keys outside the allowlist are ignored. The console install panel shows the current list; if the docs and the console disagree, the console wins. Theming does not remove Powered by ISMS Copilot.

Advanced: end-user JWT

Larger partners can mint short-lived JWTs for identified end users (partner-signed, kid-based). That path reuses the same loader with a token field and is documented in the platform console when you rotate the partner signing secret.

Most self-serve installs use the public path from the console without building a JWT issuer on day one.

Powered-by and isolation

The widget is an ISMS Copilot product. Partner data is isolated from the main chat product.

• Footer Powered by ISMS Copilot is always on for all tiers today.
• AI-generated and not-legal-advice disclosures remain in the chrome.
• Removing Powered by on paid is not current GA.

History

Multi-turn works while the widget is open. Reload or reopen starts a fresh UI conversation. Details: Conversations and history.