The Swiss Army knife for indie devs.

1Create a project

One project per app. You get a public key pk_… that’s safe in a browser and a secret sk_… that never leaves your server. Set the name replies are signed with, the origins allowed to host the chat, and who gets emailed when someone writes.

2Sign a token for the user who's signed in

One authenticated route on your server. Any JWT library works; here it is with none at all.

import { createHmac } from 'node:crypto'

// GET /api/support/token — only for a signed-in user of your app
export function mintSupportToken(user) {
  const b64 = v => Buffer.from(JSON.stringify(v)).toString('base64url')
  const now = Math.floor(Date.now() / 1000)
  const head = b64({ alg: 'HS256', typ: 'JWT' })
  const body = b64({ iss: process.env.HELP_BITES_PROJECT_KEY, sub: user.id, name: user.name, email: user.email, iat: now, exp: now + 3600 })
  const sig = createHmac('sha256', process.env.HELP_BITES_SECRET).update(head + '.' + body).digest('base64url')
  return head + '.' + body + '.' + sig
}

3Drop the chat on the page

A script tag and the function that fetches that token. That's the install.

<script src="/widget.js" data-project="pk_…" defer></script>
<script>
  window.HelpBites = window.HelpBites || []
  HelpBites.push(['init', {
    getToken: () => fetch('/api/support/token').then(r => r.json()).then(r => r.token),
    context: { type: 'page', id: location.pathname, label: document.title, url: location.href } // optional
  }])
</script>

Only the origins you listed can host it — anywhere else sees an error and never gets a token. Add data-mode="inline" with a target element and the same chat becomes a page of your app instead of a floating bubble.