Embed
The <speechify-agent> web component is the shortest path from “I have an agent ID” to “my users are talking to it on my landing page”. One script tag, one element, no realtime plumbing to wire up.
That’s the whole integration for a public agent. Private agents use the same tag with a server-minted session token (see below).
Two modes
Public agent (direct embed)
Flip the Public toggle on the agent’s Embed tab in the console, add the domains you want the widget to work on to the origin allowlist, and paste the snippet into your page. The widget calls POST /v1/agents/{id}/sessions unauthenticated; the server verifies that Origin matches your allowlist before minting a session.
Use this for marketing sites, demo pages, and anywhere the agent conversation is the product itself.
Security
- Embed only works from origins you explicitly allowlist on the agent. An empty allowlist with the public toggle on means “any origin accepted” — intended for open demos; enable deliberately.
- No subdomain wildcards. Add each origin exactly (e.g.
https://app.example.com,https://www.example.com). - The session endpoint is per-IP rate-limited. Repeat abuse from one source is throttled without affecting legitimate users.
- The agent owner is always the billed principal regardless of who triggered the session.
Hostname allowlist
An additional, narrower gate applied at session-create time for public agents. Set it in the console under Embed tab → Hostname allowlist, or via PATCH /v1/agents/{id} with the hostname_allowlist field.
- Up to 10 entries, exact hostname match (no wildcards, no subdomain matching). Scheme and port are ignored; only the
Originheader’s hostname is checked. - Empty or omitted means “no hostname enforcement”, so the session is minted as usual. Use this gate when you want the widget to work only from a known set of production hostnames, even though the agent is public.
- When non-empty, a request whose
Originhostname is not in the list is rejected with403. - Good hostnames:
example.com,app.example.com. Not accepted:*.example.com,https://example.com,example.com:8080.
Private agent (server-minted token)
Keep the agent private, mint a short-lived session token on your backend with your API key, and pass it to the widget. The API key never reaches the browser.
Python
TypeScript
cURL
Browser side:
Attributes
Per-call overrides
One embed can serve many customer segments without minting new agents. These attributes are forwarded to POST /v1/agents/{id}/sessions each time the caller starts a call, so you can update them between calls (e.g. after a user logs in) and the next call picks them up.
Overrides only apply when the widget mints the session itself (public-agent mode, or when you omit session-token). If you pre-mint a session on your backend with session-token + session-url, bake the overrides into that call server-side — the widget has no authority to change an already-issued session and will log a console warning if you combine the two.
Visual
Orb colors can also be set from external CSS via the --speechify-agent-orb-1 / --speechify-agent-orb-2 custom properties — see Styling.
Copy
All visible button text is overridable so the widget can speak any language. Each attribute is optional; defaults are in English.
Events
The element emits CustomEvents you can listen for with addEventListener:
Because speechify-agent:call bubbles (with composed: true), you can delegate-listen on an ancestor — handy when the widget is rendered by a framework and you don’t have a stable reference to the element:
Programmatic API
For React/Vue/Svelte apps that don’t want the default button UI, import the ESM bundle and call startAgent directly:
Styling
The component uses Shadow DOM so your page’s CSS can’t leak in. Light theming is exposed through CSS custom properties on the host:
Need more control than that? Use the programmatic API and build your own UI on top of the returned AgentHandle.