POST
Open an Anonymous Session

Overview

Opens a support session directly from the browser using only your app’s public key — no backend required. The endpoint validates the request Origin against your app’s allow-list, mints an SDK token, and creates a SUPPORT conversation. This powers the widget’s anonymous mode for static sites.
Auth: X-Api-Key: pk_… (public key only). The request Origin must be listed in the app’s allowed origins (dashboard → app settings). No secret key is used or needed.
Anonymous embedding is disabled by default. Add each site’s origin (e.g. https://www.example.com) to the app’s allowed origins first, or this endpoint returns 403.

Request Headers

Request Body

string
Visitor display name (optional).
string
Visitor email (optional; can be collected later via Update Visitor).

Example Request

Response

string
SDK token for this anonymous visitor.
string
The support conversation to join.
string
Generated anonymous visitor ID.
number
Token lifetime in seconds.

Success (201)

Notes

  • Rate limited per IP to prevent abuse.
  • The widget calls this for you when you pass only a publicKey — see Embed the widget. You rarely call it directly.

Error Responses

Embed the widget

Anonymous mode with a public key.

Server-side session

Provision from your backend instead.