Widget security
What the public key does and doesn't grant, and how abuse is limited.
On this page
The public key is meant to be public
Your widget snippet contains a public key visible in your page source. This is by design and is how every embedded chat widget works.
The key identifies which workspace a message belongs to. That is all it does.
| The public key can | The public key cannot |
|---|---|
| Start a chat conversation | Read your tickets |
| Fetch your widget's appearance settings | Read your contacts or orders |
| Send a message into your inbox | Change any setting |
| — | Send email on your behalf |
| — | Access billing or team data |
If you need programmatic access to your data, that is a different credential entirely — see API keys. An API key must never appear in front-end code.
Rate limiting
Both the config and message endpoints are rate limited, per key and per IP address. The per-IP limit is the tighter of the two, which is what stops a single abusive visitor from consuming your allowance while leaving genuine visitors unaffected.
If a visitor hits the limit they see a brief "too many messages" state and can continue shortly after.
What the widget stores
Conversations are stored against your workspace so agents can reply and so the thread survives a page refresh. A session identifier is kept in the visitor's browser storage to reconnect them to their own conversation — it contains no personal data and identifies nothing outside the conversation.
The widget sets no advertising or cross-site tracking cookies.
Personal data in chat
Visitors sometimes paste things they should not — card numbers, passwords. Kognit does not ask for them and the AI will not request them, but content a visitor types is stored with the conversation. If you handle sensitive categories of data, mention it in your greeting and cover chat in your privacy policy.
See Data and privacy.
Restricting where the widget loads
The widget is intended to run on your own sites. If someone copies your snippet onto an unrelated site, conversations would arrive in your inbox tagged with that origin — visible in the ticket, so it is detectable. Contact support if you see traffic from a domain you do not recognise.