Widget and agent app
Separate the customer-facing widget from the authenticated support workspace.
Customer widget
The public widget loads with a site embed identifier and uses the visitor transport. Its appearance comes from the site’s saved configuration. It lets visitors start chats and use the enabled help or booking surfaces.
Agent app
The app at https://app.message.com requires an authenticated workspace session. Agent role, department and channel permissions determine available work. Its credentials must never be used in a visitor-facing page.
Different API boundaries
Public panel controls use window.__msgWidget. Agent REST and Socket.io interfaces have separate authorization. A public embed identifier is not interchangeable with a workspace ID, agent JWT or product API key.
Identity and private data
The shipped widget does not provide a public identify, signout or userHash login API. Browser continuity and a pre-chat email are not proof of account ownership. Use the connector’s supported customer-verification flow before disclosing private order information.