Project settings
Auto-send behaviour, API keys and webhook endpoints.
Automatic answers
When on, a validated draft whose confidence clears the threshold below is sent to the end-user automatically and fires the outbound webhook. When off, every draft — however confident — waits in the agent panel.
Drafts scoring at or above this are eligible for auto-send. Lower is more automated but riskier.
API keys
| Name | Key | Type | Created | Last used |
|---|
Secret keys are shown once at creation and stored masked. The public key is safe to ship in your page source.
Webhook endpoints
| Endpoint URL | Events | Signing secret | Status |
|---|
Each endpoint has its own signing secret (whsec_…), shown once when the endpoint is created. Verify the signature on every delivery; rotate the secret if it leaks.
Embed the widget
—
This pk_… is not a secret — it belongs on the page that hosts the widget.
Loading…import jwt from 'jsonwebtoken';
// WIDGET_SECRET is read from your server environment — never sent to the browser.
const token = jwt.sign(
{ sub: '<your-user-id>', exp: Math.floor(Date.now() / 1000) + 300 },
process.env.WIDGET_SECRET,
{ algorithm: 'HS256' }
);
// Hand `token` to your page, then render the iframe above with it.The WIDGET_SECRET lives only on your backend, never in the browser. Your backend signs a short-lived token per user; desktower verifies it before showing that user's tickets.