@mintlify/assistant-widget to add your Mintlify assistant to any website or web application. The hosted package owns its trigger and renders inside a closed Shadow DOM, preventing your application styles from changing the widget.
The only required browser option is the public Widget ID from your deployment’s Settings > Widget page. The enabled state, allowed origins, starter questions, attachments, and bot protection remain managed in the Mintlify dashboard.
Replace
YOUR_WIDGET_ID in the generated code with the public Widget ID from
your deployment.Install and configure
Use the playground to configure the presentation, visual options, and observer hooks. The installation block updates as you change each option. Module scripts are deferred and run in document order. Keep the hosted loader before the initialization block when installing the widget with HTML.Use a custom trigger
Awaitinit() before calling other methods. You can keep the built-in trigger or open the configured presentation from any button in your application.
ask():
source value is included in event metadata and requests, which lets you distinguish built-in interactions from your custom entry points.
Update a mounted widget
Useupdate() to change appearance, labels, or hooks without clearing the current conversation. Only the supplied fields change.
null to restore a field or group to its default:
identity starts a new conversation. Changing the Widget ID or API endpoint requires calling destroy() before a new init().
Configuration reference
Appearance
Arbitrary CSS and neutral-palette overrides are not supported. The closed Shadow DOM protects both your application and the widget from cross-site style regressions.
Hooks
event hook receives lifecycle and interaction metadata for init, open, close, ask, update, reset, navigate, and destroy. Events do not include question text, identity, session, or CAPTCHA tokens.
The error hook receives a stable code, a retryable boolean, and an optional HTTP status. Exceptions thrown by either hook do not interrupt the widget.
Browser API
Conversation snapshots remain private to the widget. Each method resolves to
void.
Content Security Policy
If your site uses a Content Security Policy, allow the origins required by your enabled widget features:script-src:https://cdn.jsdelivr.net,https://challenges.cloudflare.com, andhttps://js.hcaptcha.comconnect-src:https://api.mintlify.com,https://challenges.cloudflare.com, andhttps://*.hcaptcha.comframe-src:https://challenges.cloudflare.comandhttps://*.hcaptcha.comstyle-src:https://cdn.jsdelivr.netand the nonce passed toinit()font-src:https://cdn.jsdelivr.netimg-src: any origins used byappearance.logo
script-src policy must still authorize both the loader and initialization script. Passing nonce to init() propagates it only to resources the widget creates after initialization.