Live chat widget
Drop in a lightweight async script. Open, close, and theme the panel from your app without rebuilding.
Live chat and support for internet businesses
Add a lightweight chat widget, verify logged-in users with HMAC-SHA256, connect server-side workflows through the REST API, and subscribe to signed webhooks — without building support infrastructure.
What is rokochat?
rokochat gives you a single platform to talk to customers, verify who they are, and automate support workflows. Instead of bolting on anonymous chat and hoping for the best, you connect once and get a widget, API, and webhooks that share the same conversation model.
Your visitors get a fast, familiar chat experience. Your team gets verified identity, custom attributes, and server-side control over every conversation.
What rokochat handles
Secure identity
HMAC-SHA256 user hashes prevent impersonation. Enable strict mode to require verified identity in production.
REST API
Manage conversations, visitors, and sites from your backend. Server keys stay server-side.
Signed webhooks
Receive conversation, message, and visitor events with rk_whsec_ signature verification.
Who is rokochat for?
Founders and teams building digital businesses where customers are logged in, context matters, and support needs to just work.
SaaS products
Support logged-in users with verified identity, custom attributes, and conversation history.
E-commerce
Help shoppers in context — cart value, plan tier, and order details travel with the session.
Developer tools
Ship a support channel alongside your API. Wire server workflows through webhooks and REST.
Agencies & marketplaces
Multi-site dashboards, per-client widgets, and team routing without custom chat infrastructure.
Why rokochat is different
Stay focused on your product. Stop duct-taping anonymous chat widgets onto authenticated apps.
Identity-first by default
Most chat widgets treat every visitor as anonymous. rokochat is built around verified user identity from day one.
One integration, full stack
Browser SDK, REST API, widget HTTP, and webhooks share the same data model — no stitching providers together.
Ship in minutes
Paste a script, hash on your server, call identify(). No heavy SDK install or iframe gymnastics.
Quickstart
Three steps to production
Copy the widget snippet, compute the identity hash on your server, then identify the user from your browser app.
1. Add the async widget
Paste the loader before </body>. No npm package or build step required in the browser.
2. Generate a server-side user hash
Use your rk_is_ identity secret on the server to HMAC the immutable user id.
3. Identify after auth loads
Pass id, user_hash, and profile fields to Rokochat.identify(), then call logout() on sign-out.
Browser install
Paste the async loader
Replace rk_pk_YOUR_KEY with the site public key from your rokochat dashboard.
<!-- rokochat -->
<script>
(function(w,d,s,k){
w.Rokochat = w.Rokochat || function(){ (w.Rokochat.q = w.Rokochat.q || []).push(arguments) };
w.Rokochat.k = k;
var f = d.getElementsByTagName(s)[0], j = d.createElement(s);
j.async = 1; j.src = 'https://cdn.rokochat.com/w.js';
f.parentNode.insertBefore(j, f);
})(window, document, 'script', 'rk_pk_YOUR_KEY');
</script>Identity
Call secure identify()
HMAC the immutable user id with your server-only identity secret. Pass only the resulting hash to the browser.
// Node.js — server route
import { createHmac } from "node:crypto";
export function rokochatUserHash(userId: string): string {
return createHmac("sha256", process.env.ROKOCHAT_IDENTITY_SECRET!)
.update(userId).digest("hex");
}
// Browser — after your auth layer loads
Rokochat.identify({
id: user.id,
user_hash: serverProvidedHash,
email: user.email,
name: user.name,
});Call Rokochat.logout() on your app's logout.
Server examples
Generate user_hash in major languages
These examples produce the lowercase hex HMAC-SHA256 digest that Rokochat.identify() expects.
import { createHmac } from "node:crypto";
export function rokochatUserHash(userId: string): string {
return createHmac("sha256", process.env.ROKOCHAT_IDENTITY_SECRET!)
.update(userId)
.digest("hex");
}For AI coding agents
What to install and write
Good to go?
Keep building
Read the API reference
Every endpoint, object, and error with copy-paste examples.
Identity verificationHMAC-SHA256 user hashes, strict mode, and logout rules.
WebhooksSigned event delivery for conversations, messages, and visitors.
Custom support buttonsOpen chat from your own buttons and hide the default bubble.
Frameworks