> ## Documentation Index
> Fetch the complete documentation index at: https://docs.raum.am/llms.txt
> Use this file to discover all available pages before exploring further.

# Install the widget

> Install RAUM Chatbot with HTML, npm/JavaScript, React, Next.js, Node-served pages, or WebViews using an origin-bound publishable key and required CSP.

Open **Chatbot → Widgets → Installation** after configuring the widget draft and allowed website origins.

## Allowed origins first

Enter exact HTTPS origins, one per line. The runtime rejects a host page that is not on the widget's allowlist.

The publishable key is **browser-visible and origin-bound**. It is designed to be placed in client code.

> [!WARNING]
>
> Never place a RAUM organization API token, Zendesk API token, AI-provider key, or other server credential in the widget snippet.

## Publishable key lifecycle

The key is shown when the widget/channel is created or when you rotate it.

If no current one-time key is in the page state, Installation does not fabricate a copy-paste-looking placeholder. Rotate the key to generate fresh installation examples.

When rotating, RAUM can keep the previous key valid until a displayed expiration time so you can update every allowed website safely.

## Plain HTML

The generated HTML uses RAUM's public loader and includes the widget public ID, publishable key, key version, and RAUM service URL.

## JavaScript / npm

Use the **@raum-ai/chat-widget** package. The returned controller supports operations such as open, close, identify with a signed token, and destroy.

The npm package is intentionally thin. The RAUM loader remains the single browser runtime so the wrapper cannot drift into a second implementation.

## React and Next.js

Use **@raum-ai/chat-widget/react** for React.

In Next.js App Router, render it from a **client component** because the widget runtime is browser-only.

## Node / Express

There is no server-side Chatbot runtime for Express. Your server renders or serves a page containing the normal browser snippet.

## Android and iOS WebViews

There is currently **no native mobile SDK**.

Load an HTTPS page you control that contains the widget in Android WebView or iOS WKWebView with JavaScript and DOM storage enabled. Keep navigation constrained to your site and the RAUM service.

## One widget per page

The public loader exposes one launcher/controller on a page. Mounting the same widget more than once shares the existing loader. Attempting to mount a different widget into the same page is rejected rather than silently replacing the first one.

## Content Security Policy

A host page with CSP must allow the RAUM service for **script-src**, **style-src**, **frame-src**, and **connect-src**.

style-src matters because the loader injects the widget stylesheet. A CSP that allows the script and frame but blocks the stylesheet can produce a widget that technically loaded and visually looks like it lost a disagreement with CSS.

Use the exact CSP guidance displayed by the Installation tab for your deployment service URL.

## Verify after installation

From a real allowed origin, confirm the launcher, open/close behavior, conversation creation, localization, approved knowledge, attachments/forms, dashboard Conversation record, and any configured identity/public connections.

> **[Visitor identity](https://docs.raum.am/chatbot/visitor-identity.md)**
>
> Pass signed identity or verify email before account-specific public access.

> **[Safety & Simulation](https://docs.raum.am/chatbot/safety-simulation.md)**
>
> Test origins, public resources, actions, and failure behavior before launch.


This documentation is built and hosted on [Mintlify](https://mintlify.com), a developer documentation platform.