Add Ask AI to your website

The widget puts an assistant on your own website, and installing it is one pasted line of HTML. Visitors who have never signed in can ask questions and get grounded answers with citations, in a panel that opens from an Ask AI launcher button, or from a button of your own.

Set it up

Open Integrations → Website widget in the console. The guide there, Add Ask AI to your website, takes three steps: your website’s address, one line to paste, and a check that the line is there. An Owner, Administrator or Editor can run it.

Enter your website's address

Type the address people use to visit your site, such as https://www.example.com, and select Set up my website. The console then does three things and reports each as it finishes:

Read your website. It connects the address as a website source, reading up to 250 pages of that site and not its subdomains, so the assistant can answer from them. Reading carries on in the background. If you already have sources, this is a tick box, Also read this website as a knowledge source, and you can leave it off.
Prepare the assistant. It uses an active assistant of yours that can already answer. If none can, it attaches your knowledge to the active assistant you have, or creates one named Website assistant.
Create the widget. It creates an embed for that assistant, allowed on exactly the address you typed.

Nothing is made twice: running the setup again for the same address finds what already exists, and a setup that stopped half way is finished by running it again.

Copy one line

The guide shows the line to paste. Select Copy, or Email to my developer to open a message in your mail program with the line and a link to these instructions; you choose who receives it.Paste the line, unchanged, before the closing </body> tag on every page that should show the widget, or once into the template every page shares. It is one script tag:

<script src="https://app.mithunai.com/widget/mithunai-widget.js"
        data-api-base-url="https://app.mithunai.com/mithunai/api/v1"
        data-widget-key="mithunai_wk_..." defer></script>

There is no second script to add and nothing to edit. Install it on your platform says where the line goes in WordPress, Shopify, Webflow, Wix, Google Tag Manager, React, Next.js and Docusaurus.The line can be copied again at any time from the embed’s row, so losing it never orphans an embed.

Check my website

Enter the address of any page that has the line on it and select Check. MITHUNAI reads that page and tells you what it found. What the check reports explains each result.Then open your page, select the Ask AI button at the bottom right and ask a question your content covers.

While your website is still being read, the Ask AI button already appears on your site, and the assistant answers from your pages once reading finishes. Until then it may reply that it does not know. Follow the progress under Sources.

Try the widget on a staging copy of your site before you launch. Your own page is the real test of your allowed origins, your Content-Security-Policy and the scripts your site already runs.

What the check reports

Result	Meaning	What to do
The widget is on that page (`installed`)	The page’s HTML contains this embed’s line	Nothing. Open the page and ask a question
A different key (`key_missing`)	A MITHUNAI widget is on the page, but with another embed’s key	Replace the line on your site with the one the console shows
The line was not found (`not_found`)	The page’s HTML does not contain the widget’s script	Paste the line and publish. If you added it through a tag manager or with JavaScript, see below
Not an allowed website (`origin_not_allowed`)	The page’s origin is not in the embed’s allowed origins, so the widget will not load there	Select Allow followed by the origin (for example Allow https://www.example.com) under the result, or add the origin under Allowed origins
That page could not be read (`unreachable`)	MITHUNAI could not fetch the page, or the page answered with an error status, which the result shows	Check the address and that the page is public. If the address redirects, enter the address it ends up on
The page could not be checked	The console did not recognise the result	Open your website and look for the Ask AI button

The names in brackets are the values Check a widget installation returns.

What the check cannot see

The check reads one page the way a search engine’s crawler would, and that has limits worth knowing before you act on a result.

It reads the page’s HTML only and runs no script. A line added by a tag manager, a consent tool or JavaScript is not in that HTML, so a working widget can read as not found. Open your site and look for the Ask AI button.
It does not follow redirects. An address that redirects to one ending in a slash, for example from /docs to /docs/, reads as could not be read. One that redirects to another host, for example from example.com to www.example.com, is checked against the embed’s allowed websites first, so it reads as not allowed unless the address you typed is itself allowed. Enter the final address, the one in the browser’s address bar once the page has loaded.
The page must be public. A page on your own computer, behind a sign-in or on a private network cannot be read.
It describes the page, not the embed. A page that still carries the line of a revoked embed reads as installed.
It reads the first megabyte of the page, which is enough for any ordinary page.

Create an embed by hand

To choose the assistant yourself, list several origins or script the setup, create the embed directly.

Console
API

Open Integrations → Website widget and select New embed.
Enter a Name, choose the Assistant that should answer, and list your site under Allowed origins, one per line. Only an active assistant can be chosen.
Select Create embed. The embed appears in the list with its line to paste, which contains its widget key (mithunai_wk_…), and its own Check.

curl --request POST "$MITHUNAI_URL/mithunai/api/v1/widget-deployments" \
  --header "Authorization: Bearer $MITHUNAI_API_KEY" \
  --header "Content-Type: application/json" \
  --data '{
    "name": "Docs site",
    "assistant_id": "<assistant id>",
    "allowed_origins": ["https://docs.example.com"]
  }'

The response contains widget_key; write the line above with it. See Create a widget deployment.

The embed must list your site’s exact origin, such as https://docs.example.com. See Allowed origins.

Snippets pasted earlier

Snippets pasted earlier, which set the same values on a window.mithunaiWidget object in a script of their own before the tag, keep working unchanged; that is now the object form.

Configuration options

Each option is a data- attribute on the script tag. Only the first two are required, and the snippet you copy already carries them.

Attribute	Required	Description
`data-api-base-url`	Yes	Your MITHUNAI API base URL, ending in `/mithunai/api/v1`
`data-widget-key`	Yes	The embed’s public key, starting with `mithunai_wk_`
`data-title`	No	The panel’s title. Defaults to your brand’s product name. Up to 60 characters
`data-launcher-label`	No	What the launcher button reads. Defaults to `Ask AI`. Up to 60 characters
`data-launcher`	No	`false` hides the built-in launcher, for a site that opens the widget from its own element. Defaults to `true`
`data-position`	No	`right` (default) or `left`
`data-default-open`	No	`true` opens the panel on page load. Defaults to `false`
`data-shortcut`	No	`true` makes `Ctrl`+`K` / `Cmd`+`K` open and close the widget. Defaults to `false`
`data-mode`	No	How the widget appears: `chat` (default), `sidebar`, `search` or `deflector`. See Ways it can appear
`data-target`	For `search` and `deflector`	A CSS selector of the element the search box or deflector appears in
`data-form`	For `deflector`	A CSS selector of your support form
`data-fields`	For `deflector`	CSS selectors of the form’s fields to read, comma-separated, such as `#subject, #description`

An on-or-off attribute takes exactly true or false, in lower case: write data-shortcut="true", not data-shortcut on its own. An attribute the widget does not know is ignored, so a snippet written for a newer widget still loads on an older one. A known attribute with a value it cannot accept is refused: the widget logs what is wrong and renders nothing.

Ways it can appear

One embed can appear four ways. The choice is in the line you paste, so the same embed can be a chat bubble on one page and a search box on another. In the console, How it appears beside the line writes it for you.

Chat bubble (chat, the default). A button in the corner opens a panel with the conversation.
Docked sidebar (sidebar). The same button opens the panel docked to the full height of the left or right edge (data-position).
Search box (search). A search box inside the element data-target names. Each search is answered on its own, with citations and the list of sources it used, and does not carry on from the one before.
Form deflector (deflector). See below.

Setting the default for an embed (Beta)

An embed can also store how it appears when the page’s snippet has no data-mode. In the console, open Widget embeds, find the embed and use Presentation (Beta): Let the page decide (the default), Chat bubble or Docked sidebar. The widget reads the stored value when it loads, so changing it reaches every page already carrying the snippet, within the 30 minutes a tab keeps its last answer.

A snippet that sets data-mode always wins. The stored value applies only to a page whose snippet names no mode.
Only the chat bubble and the docked sidebar can be stored. The search box and the deflector need data-target (and, for the deflector, data-form and data-fields), which only the page can name, so they are set in the snippet. A value of either that was stored through the API is shown in the console and is not applied.
Off by default. Your deployment’s operator turns on stored presentations. While they are off the console’s save is refused with the platform’s message, nothing is stored, and the snippet decides, as before. Access on request.

The same value is presentation on Create a widget embed and Update a widget embed; null clears it. The search box and the deflector need their elements to exist when the page loads. If one is missing, or a selector is not valid, the widget logs which one in the browser console and shows nothing.

Form deflector

The deflector sits beside your support form. As a customer types into the fields data-fields names (typically the subject and the description), it waits until they pause and there is enough to go on, then shows a cited answer inside data-target. It never stops the form being sent.

<div id="mithunai-deflector"></div>
<form id="support-form">
  <input id="subject" name="subject" />
  <textarea id="description" name="description"></textarea>
  <button>Send</button>
</form>
<script
  src="https://app.mithunai.com/widget/mithunai-widget.js"
  data-api-base-url="https://app.mithunai.com/mithunai/api/v1"
  data-widget-key="mithunai_wk_..."
  data-mode="deflector"
  data-target="#mithunai-deflector"
  data-form="#support-form"
  data-fields="#subject, #description"
  defer
></script>

Under the answer is This answered my question. What happens next is counted in Usage analytics under Support form deflector: visitors who said it helped and did not send the form, and visitors who sent it anyway. A visitor who says it helped and then sends the form anyway counts as sent. Only what was typed into the fields you name is read, and it is sent as a question exactly as one typed into the chat would be. The same options can be set as fields of a window.mithunaiWidget object instead, which is also how your own page opens the widget and asks it questions. See Widget customisation. Colours, logo and product name come from your organisation’s branding, so one snippet stays correct when you rebrand. The widget renders inside a shadow root, so your site’s styles do not change it and its styles do not leak onto your page. It is a non-modal panel: it moves focus in when opened, returns focus to the launcher when closed (or, when you hide the launcher, to whatever had focus before), closes on Escape, and never traps keyboard focus or locks page scrolling.

Install it on your platform

The widget needs one thing on every page: its script tag. Loading it twice shows one widget, never two. Add defer or leave it out; do not add type="module", which stops the widget reading its own tag.

Paste the line before the closing </body> tag of every page, or once into the template every page shares.

Paste the line just before </body> in your theme’s footer template, usually footer.php. Edit a child theme, so a theme update does not remove it. If you would rather not edit the theme, a plugin that adds code to the site footer does the same job.A plugin that combines, defers or delays JavaScript can rewrite script tags. If the button does not appear with one active, exclude the widget’s script from it.

In your Shopify admin, open Online Store → Themes, choose Edit code on your theme, and open layout/theme.liquid. Paste the line just before </body> and save.

Use this form in a Custom HTML tag, fired once on all pages, instead of the one-line snippet:

<script>
  window.mithunaiWidget = {
    apiBaseUrl: 'https://app.mithunai.com/mithunai/api/v1',
    widgetKey: 'mithunai_wk_...'
  };
  (function () {
    var script = document.createElement('script');
    script.src = 'https://app.mithunai.com/widget/mithunai-widget.js';
    document.head.appendChild(script);
  })();
</script>

The one-line snippet carries its settings in data- attributes, and Tag Manager has been reported to remove those from a tag it injects. This form puts the settings in script, where nothing can remove them. Check my website cannot see a widget added this way, because the line is not in the page’s HTML.

In a React app with an index.html, such as one built with Vite, paste the line into index.html before </body>.In Next.js, add it once in the root layout with next/script, which passes data- attributes through to the tag it creates:

import Script from 'next/script'

export default function RootLayout({ children }) {
  return (
    <html lang="en">
      <body>
        {children}
        <Script
          src="https://app.mithunai.com/widget/mithunai-widget.js"
          data-api-base-url="https://app.mithunai.com/mithunai/api/v1"
          data-widget-key="mithunai_wk_..."
        />
      </body>
    </html>
  )
}

With the Pages Router, put the same <Script> in pages/_app.jsx. A layout does not unmount on client navigation, so the widget and the visitor’s conversation stay as they move between pages. Do not put it in a page component.To add it from your own code instead, create the tag and set its attributes before appending it:

const script = document.createElement('script')
script.src = 'https://app.mithunai.com/widget/mithunai-widget.js'
script.dataset.apiBaseUrl = 'https://app.mithunai.com/mithunai/api/v1'
script.dataset.widgetKey = 'mithunai_wk_...'
document.body.append(script)

Add the tag with scripts in docusaurus.config.js. Each key of the object becomes an attribute of the tag:

export default {
  scripts: [
    {
      src: 'https://app.mithunai.com/widget/mithunai-widget.js',
      defer: true,
      'data-api-base-url': 'https://app.mithunai.com/mithunai/api/v1',
      'data-widget-key': 'mithunai_wk_...',
    },
  ],
}

Which platforms are verified

The steps above follow each platform’s own documentation for adding a script. This table says which of them MITHUNAI has run itself.

Platform	Status
Plain HTML, and a tag created from your own code	Run in an automated Chromium browser: a plain HTML page on a second website loaded the line the console gave out and talked to the MITHUNAI server as it ships, over plain HTTP. Not yet on a real website over HTTPS
The Google Tag Manager form above	Not verified by us inside a Tag Manager container
WordPress, Shopify, Webflow, Wix	Not verified by us on a real site
Next.js, Docusaurus	Not verified by us in a real project. Both document that they pass `data-` attributes on

If the button does not appear on a platform marked not verified, check the page’s HTML source for the script tag and its two data- attributes. If the platform has removed them, use the object form, which does not depend on them.

Content-Security-Policy

If your site sends a Content-Security-Policy, the widget needs these four directives. Replace https://app.mithunai.com with the origin your snippet names.

Directive	Add	Why
`script-src`	`https://app.mithunai.com`	The widget script is loaded from it
`connect-src`	`https://app.mithunai.com`	Every request the widget makes goes to the API base URL and nowhere else
`style-src`	`'unsafe-inline'`	The widget writes its stylesheet into its own shadow root, which your page’s policy still governs
`img-src`	`data:`	The default brand mark is an inline image. If your branding sets a hosted logo, add its origin as well

The one-line snippet has no inline script, so script-src needs nothing more. The object form and the Google Tag Manager form do have one, which script-src must also allow: with 'unsafe-inline', with a nonce or a hash. The widget loads no fonts, frames or media, and needs no font-src, frame-src or media-src entry.

Allowed origins

The embed must list the exact origin of every site that shows the widget. An origin is a scheme, host and optional port, such as https://docs.example.com.

Exact match only. There is no wildcard. https://example.com does not match https://www.example.com; list each one.
No trailing slash or path. https://docs.example.com/ is invalid.
Empty means nowhere. An embed with no allowed origins works on no site.

An allowed origin decides where a browser may show the widget. It is not authentication: a client outside a browser can send any Origin it likes, which is why the widget key grants so little on its own. A deployment can also keep a list of its own, in which case a website must be on both. If your origin is listed on the embed exactly and the widget is still refused there, ask whoever operates your MITHUNAI deployment to allow it. Update the list at any time from Integrations → Website widget or with Update a widget deployment. Sending a new list replaces the old one. The widget key sits in your page’s HTML where anyone can read it. That is expected: it is not a password and carries almost no authority. Holding it lets someone:

start a conversation with the one assistant the embed names,
ask questions in a conversation they started,
read back their own conversation, and rate the answers in it.

It does not let anyone read your knowledge, list documents, see your settings or members, or read another visitor’s conversation. Requests must also come from an allowed origin and are rate limited.

Never put an API key (mithunai_sk_…) in a web page. API keys are secrets. The widget refuses one, but the value is still published in your page source. If this has happened, revoke the key immediately.

Visitor conversations

Each conversation belongs to the browser tab that started it:

Situation	Result
The visitor closes the panel	The conversation is kept, and an answer still arriving keeps arriving
The visitor reloads the page	The same conversation is shown when they reopen the widget
The visitor moves to another page of your site	The same conversation is shown when they reopen the widget
The visitor selects New conversation	A clean conversation starts, and the previous one is forgotten on that device
The conversation is no longer available on the server	The widget shows a fresh conversation, with no error
The visitor opens a second tab	A new conversation starts
The visitor closes the tab	The conversation cannot be resumed
Another visitor tries to open the conversation	Refused

The conversation is read back only when the visitor opens the widget, so a visitor who never opens it costs nothing against your request budget. Conversations deliberately do not survive a closed tab. Public pages are often read on shared computers, and remembering a conversation would show the next person what the previous visitor typed.

Feedback and copying

Under each finished answer a visitor can copy it, with its numbered sources, and rate it with a thumbs up or thumbs down. A reply in which the assistant declined can be rated but not copied. A thumbs down offers an optional note of up to 1,000 characters. Selecting the other thumb changes the rating, and selecting the same thumb again withdraws it. An answer rated unhelpful appears under Coverage gaps in the console as rated unhelpful, with the visitor’s note, alongside the questions the assistant could not answer. A visitor can rate only answers in their own conversation. A rating is stored but not shown again after a reload: the thumbs under an answer that was read back start unset, because reading each rating back would spend the embed’s request budget. Selecting a thumb then sets or replaces the stored rating. A custom interface can do the same with Rate a widget answer, Get a widget answer’s rating and Withdraw a widget answer’s rating.

Revoke an embed

Revoke an embed from Integrations → Website widget or with Revoke a widget deployment. It stops working on the next request, and revocation is permanent. To move a site to a different assistant, create a new embed, replace the widget key in your snippet, then revoke the old one. An embed’s assistant cannot be changed after creation.

Limits

Each visitor has a request budget of 20 requests per minute on each embed, and the embed has a ceiling of 600 requests per minute across all its visitors, both separate from your API traffic. A visitor is counted by the network address their requests come from, so visitors behind one address share their 20. Asking a question and rating the answer takes about three requests. Over budget, requests receive 429 with a Retry-After header, and the response carries the cross-origin header for your allowed origin, so code of your own that calls the widget endpoints can read both.
If the rate-limiting service is unavailable, widget requests are refused rather than served without limits.
Every answer counts against your organisation’s monthly answer allowance. When it is used, a visitor who asks sees “The monthly answer limit for this account has been reached.” and no retry is offered.
The widget spends those budgets carefully: it checks that the embed is live once per browser tab and reuses the answer for up to 30 minutes, instead of asking on every page view. A change to your branding therefore reaches a tab that is already browsing within 30 minutes, and a new tab at once. Revocation is not delayed by this: it is enforced on every request.

If a page will serve more traffic than this, talk to your MITHUNAI contact rather than splitting one site across several embeds. To build a custom interface instead, call the public widget endpoints from the browser with the widget key and visitor token. A button that never renders is nearly always one of five things: the line is not in the page that was actually served, your platform removed the tag’s data- attributes, the snippet was edited after it was copied, the page’s origin is not in the embed’s allowed origins, or the embed has been revoked. Start with Check my website under Integrations → Website widget, which settles the first and the fourth; the browser’s developer console names most of the others, because a misconfigured widget logs one message saying what is wrong and renders nothing. Troubleshooting works through each cause, including the case where the widget appears but every question fails.

Next steps

Customise the widget: its label, position and shortcut, and opening it from your own button.
Branding: the colours, logo and name the widget shows.
Coverage gaps: the questions visitors asked that your content could not answer.

MITHUNAI RAG

Knowledge sources

Answers and assistants

Deploy

Analyze

Add Ask AI to your website

Set it up

What the check reports

What the check cannot see

Create an embed by hand

Snippets pasted earlier

Configuration options

Ways it can appear

Setting the default for an embed (Beta)

Form deflector

Install it on your platform

Which platforms are verified

Content-Security-Policy

Allowed origins

The widget key is public by design

Visitor conversations

Feedback and copying

Revoke an embed

Limits

Build your own widget

If the widget does not appear

Next steps

​Set it up

​What the check reports

​What the check cannot see

​Create an embed by hand

​Snippets pasted earlier

​Configuration options

​Ways it can appear

​Setting the default for an embed (Beta)

​Form deflector

​Install it on your platform

​Which platforms are verified

​Content-Security-Policy

​Allowed origins

​The widget key is public by design

​Visitor conversations

​Feedback and copying

​Revoke an embed

​Limits

​Build your own widget

​If the widget does not appear

​Next steps

Set it up

What the check reports

What the check cannot see

Create an embed by hand

Snippets pasted earlier

Configuration options

Ways it can appear

Setting the default for an embed (Beta)

Form deflector

Install it on your platform

Which platforms are verified

Content-Security-Policy

Allowed origins

The widget key is public by design

Visitor conversations

Feedback and copying

Revoke an embed

Limits

Build your own widget

If the widget does not appear

Next steps