Chat embed cookbook - CodeB native chat inside your app.
CodeB tenants ship a first-class chat surface at chat.html - DMs, group chats and meeting threads, stored per-tenant on the same domain as the softphone and meeting rooms. Embed it in three lines. European Digital Identity Wallet compatible: the visitor signs in through the tenant OIDC provider (or European Digital Identity Wallet via logineu.html) before the chat mounts.
See also: 6 embed recipes
| Integration | Mechanism | Best for | Snippet |
|---|---|---|---|
| iframe embed | chat.html iframe | Zero-code drop-in on any HTML page. | iframe-embed.html |
| Popup window | window.open | Sticky chat button, opens beside app. | popup-open.js |
| React wrapper | iframe component | React SPAs. | chat-embed-react.jsx |
| Vue wrapper | iframe component | Vue 3 SPAs. | chat-embed-vue.js |
| Angular wrapper | iframe component | Angular SPAs. | chat-embed-angular.ts |
| WordPress shortcode | PHP plugin | WordPress sites; no JavaScript wiring. | chat-embed-wordpress.php |
Deep-link URL parameters
Any link to /chat.html can carry query-string parameters that jump the visitor straight into a specific conversation. Useful for cross-linking from tickets, e-mail templates, meeting follow-ups or bookmarklets. All parameters are URL-decoded by the browser and safe to percent-encode.
| Parameter | Value | Effect |
|---|---|---|
?with=<login> | User login (usually the e-mail form) | Opens a direct-message thread with the given user. If a DM already exists it is opened; otherwise a new DM is initiated (blocked for guest role). |
?group=<groupId> | Group id (e.g. g_marketing2026) | Opens the named group thread. Requires membership - the server rejects non-members on the first message-list fetch. When both ?with and ?group are supplied, ?with wins. |
?msg=<text> | Message body, max 4000 chars | Prefills the composer with this text. Never auto-sends unless ?send=1 is also present. |
?send=1 | Boolean flag | Sends the ?msg value immediately after the thread opens. Ignored for guest role and ignored without ?msg. |
Examples
- Support template -
/chat.html?with=support@aloaha.com&msg=Ticket%20%23123 - Project follow-up -
/chat.html?group=g_project_x - Compose bookmarklet -
javascript:location.href='/chat.html?msg='+encodeURIComponent(window.getSelection()) - One-shot notify -
/chat.html?with=alice&msg=Deploy%20green&send=1(staff role only)
Full parameter reference also lives inline at the top of chat.html for maintainers.
Authentication model
The embedded chat is session-authenticated. When chat.html loads without a valid tenant session cookie, it redirects to /login.html (or /logineu.html for European Digital Identity Wallet sign-in) and returns to chat after successful auth. No Bearer token is passed through the iframe URL.
Inviting external users (no OIDC account)
Real signed-in users can mint one-time invite links to bring an external guest into one specific DM or group. From chat.html: Invite external button - pick a display name and optionally the target thread - the modal returns a copy-able URL plus a QR code. The invited person opens the URL, clicks Continue, and lands in that one conversation as a invited_<id> guest. The guest cannot enumerate tenant users, message anyone else, create groups, upload outside the target thread, or see meeting archives. Invites are single-use, HMAC-keyed, per-tenant, default TTL 7 days (max 30). Admins review + revoke live invites from chat-invites-admin.html. Full endpoint contracts (invite-create / invite-list / invite-revoke / invite-redeem) live in api-docs.html. Server storage: App_Data/<tenant>/chat-invites/. Guest role and its scope enforcement are handled server-side by every message-write and message-read handler - the client-side hiding of the + New chat and Invite external buttons is only cosmetic.
RASP posture
All chat traffic goes through chat.ashx with IpAllowGate, per-tenant isolation, and loud [CHAT-*] + [CHAT-DIAG] diagnostics at every branch. Cross-tenant access is impossible - messages are keyed by tenant domain.
NIS2 / DORA / CRA
Chat retention, message export and audit trails follow the same per-tenant JSON-in-App_Data pattern as calls. NIS2 incident detection and DORA operational-resilience monitoring flow through the same log pipe consumed by the SIEM cookbook. Chat is filesystem+JSON per tenant, no database.
FAQ
Structured answers embedded in the schema block above.