README

Adds the Chatixy AI support agent to every front-end page of a Craft CMS site. Install, paste your widget key, save. No template edits, no Twig tag to place, no partial to include.

Requirements


Craft CMS	4.0+ or 5.x (`craftcms/cms: ^4.0 \|\| ^5.0`)
PHP	whatever your Craft version already requires - the plugin adds no floor of its own
Chatixy account	any plan; a widget key is all the plugin needs

Install

composer require chatixy/craft-chatixy
php craft plugin/install chatixy

Then open the control panel and go to Settings -> Plugins -> Chatixy AI Support Agent. Turn Enable Chatixy support agent on, paste the Widget key from your Chatixy dashboard (under Install), and save.

The field accepts any of the three shapes the dashboard hands out:

the bare 64-character key,
<key>.js,
the whole <script src="https://chatixy.com/source/<key>.js" async></script> snippet.

The first 64-character hex run is extracted from whatever you paste, and the value is lower-cased for you. Leave it empty and the plugin does nothing at all.

No Chatixy account yet? Start at https://chatixy.com/register.

What it does

On every front-end page it prints one tag at Craft's end-of-body hook (craft\web\View::EVENT_END_BODY), the same place Craft emits its own end-of-body HTML:

<script src="https://chatixy.com/source/<key>.js?platform=craft" async></script>

That is the whole payload. Nothing is added to <head>, no CSS, no extra requests from the server side. The src is HTML-escaped before it is printed.

Where it does not inject

By design:

The control panel. The listener returns immediately on any CP request (Craft::$app->getRequest()->getIsCpRequest()), so your editors never get a live support agent inside the CP.
When the enable switch is off. The enabled setting is checked before anything else is built.
When the key is missing or malformed. Anything that is not exactly 64 lowercase hex characters after sanitisation is dropped, and no tag is printed rather than a broken one.

Settings

Two fields, and only two:

Field	Meaning
Enable Chatixy support agent	master switch; on by default
Widget key	your Chatixy widget key, or the whole embed snippet

There is deliberately no host field - see below. If an older settings blob still carries a host value it is simply ignored, because Craft's model only declares enabled and widgetKey, so the plugin still loads cleanly.

Security: the origin is pinned

The widget key is public; the host is not configurable. There is no "advanced host" field, no config key and no environment variable, because the stored host would build a first-party <script src> on every page of the site - i.e. site-wide stored XSS if it could be influenced. Every loader URL still goes through ChatixyKey::sanitizeHost() as a single choke point, and that method ends in an allow-list: only an https origin whose host is chatixy.com or a subdomain of it is accepted, and anything else is replaced with https://chatixy.com. The pattern is anchored at both ends and requires a literal dot before the canonical domain, so evilchatixy.com, chatixy.com.evil.example, chatixy.com@evil.example and http://chatixy.com are all rejected.

Support

MIT licensed. See LICENSE.

chatixy / craft-chatixy

Package info

Security

Statistics