Skip to main content
Use @mintlify/assistant-widget to add your Mintlify assistant to any website or web application. The hosted package owns its trigger and renders inside a closed Shadow DOM, preventing your application styles from changing the widget. The only required browser option is the public Widget ID from your deployment’s Settings > Widget page. The enabled state, allowed origins, starter questions, attachments, and bot protection remain managed in the Mintlify dashboard.
Replace YOUR_WIDGET_ID in the generated code with the public Widget ID from your deployment.

Install and configure

Use the playground to configure the presentation, visual options, and observer hooks. The installation block updates as you change each option. Module scripts are deferred and run in document order. Keep the hosted loader before the initialization block when installing the widget with HTML.

Use a custom trigger

Await init() before calling other methods. You can keep the built-in trigger or open the configured presentation from any button in your application.
To open the widget and immediately send a question, call ask():
The source value is included in event metadata and requests, which lets you distinguish built-in interactions from your custom entry points.

Update a mounted widget

Use update() to change appearance, labels, or hooks without clearing the current conversation. Only the supplied fields change.
Pass null to restore a field or group to its default:
Changing identity starts a new conversation. Changing the Widget ID or API endpoint requires calling destroy() before a new init().

Configuration reference

Appearance

Arbitrary CSS and neutral-palette overrides are not supported. The closed Shadow DOM protects both your application and the widget from cross-site style regressions.

Hooks

The event hook receives lifecycle and interaction metadata for init, open, close, ask, update, reset, navigate, and destroy. Events do not include question text, identity, session, or CAPTCHA tokens. The error hook receives a stable code, a retryable boolean, and an optional HTTP status. Exceptions thrown by either hook do not interrupt the widget.

Browser API

Conversation snapshots remain private to the widget. Each method resolves to void.

Content Security Policy

If your site uses a Content Security Policy, allow the origins required by your enabled widget features:
  • script-src: https://cdn.jsdelivr.net, https://challenges.cloudflare.com, and https://js.hcaptcha.com
  • connect-src: https://api.mintlify.com, https://challenges.cloudflare.com, and https://*.hcaptcha.com
  • frame-src: https://challenges.cloudflare.com and https://*.hcaptcha.com
  • style-src: https://cdn.jsdelivr.net and the nonce passed to init()
  • font-src: https://cdn.jsdelivr.net
  • img-src: any origins used by appearance.logo
A strict script-src policy must still authorize both the loader and initialization script. Passing nonce to init() propagates it only to resources the widget creates after initialization.