Install the embed snippet

Snippet shape

The console shows a ready-to-paste snippet. Conceptually it looks like:

<script src="https://embed.ismscopilot.com/loader.js"></script>
<script>
  IsmsCopilotEmbed.init({
    partnerId: "<your-partner-id>",
    publicKey: "<public-key-from-console>",
    // Advanced partner path instead of publicKey:
    // token: "<end-user JWT from your backend>",
    // optional: title, language ("en"), position ("right" | "left"),
    // theme: { "--ic-accent": "#4D4CD7" }
  });
</script>

Always prefer the snippet the console generates. Field names (publicKey, partner id, theme keys) can evolve; if the docs example and the console disagree, the console wins.

Domains

For live visitor traffic, add the origins where the widget will load (your marketing site, app subdomain, etc.). Traffic from domains that are not allowlisted is rejected.

The install panel can still show the snippet before every domain is configured so you can prepare the change; production visitors need the allowlist.

Theming

Optional CSS variables (for example --ic-accent) let the bubble match your brand. Exact keys appear in the console install panel.

Advanced: end-user JWT

Larger partners can mint short-lived JWTs for identified end users (partner-signed, kid-based). That path reuses the same loader with a token field and is documented in the platform console when you rotate the partner signing secret.

Most self-serve installs use the public path from the console without building a JWT issuer on day one.

Powered-by and isolation

The widget is an ISMS Copilot product. Partner data is isolated from the main chat product. Footer / powered-by treatment follows the live console and Trust Center disclosures.