README

Adds the Chatixy AI chat widget to every front-end page of a Statamic site. Install, paste your widget key, save. No template edits, no {{ ... }} tag to place, no partial to include.

Requirements


Statamic	6.0+
PHP	8.3+ (Statamic 6's own floor)
Licence	works on Core (the free tier) as well as Pro

Statamic 5 is not supported - it has no addon settings screen. See the repo README for the reasoning.

Install

composer require chatixy/statamic-chatixy

Then open the Control Panel and go to Tools -> Addons -> Chatixy AI Chat. Paste the Widget key from your Chatixy dashboard and save.

The field accepts any of the three shapes the dashboard hands out:

the bare 64-character key,
<key>.js,
the whole <script src="https://chatixy.com/source/<key>.js" async></script> snippet.

The key is extracted from whatever you paste. Leave it empty and the addon does nothing at all.

No Chatixy account yet? Start at https://chatixy.com/register.

What it does

On every front-end HTML response it splices one tag in before the closing </body>:

<script src="https://chatixy.com/source/<key>.js?platform=statamic" async
        data-chatixy-source="statamic"></script>

That is the whole payload. Nothing is added to <head>, no CSS, no extra requests from the server side.

Static caching

The addon injects inside Statamic's static-cache middleware, so the tag is part of the bytes the cacher stores - it survives into both the half-measure cache and the full-measure .html files on disk. There is no per-request PHP cost on a cache hit.

The consequence is that changing the key has to invalidate those cached pages, or the site keeps serving the old key. The addon does that for you: it listens for Statamic\Events\AddonSettingsSaved and calls StaticCache::flush() when its own settings are saved and a static-caching strategy is configured. If you ever edit resources/addons/statamic-chatixy.yaml by hand instead of using the CP screen, no event fires, so flush it yourself:

php please static:clear

Where it does not inject

By design, and unit tested:

Anything that is not text/html. JSON, RSS/Atom, XML sitemaps and Route::statamic(..., ['content_type' => ...]) views all travel through the same middleware group as pages. They are returned byte-for-byte untouched.
HTML with no </body> - an AJAX fragment or partial has nowhere correct to put a script.
The Control Panel, and Live Preview (any request carrying a Statamic token), so your editors never get a live visitor chat inside the preview iframe.
Redirects, streamed responses and file downloads.
A page that already carries the loader - exactly one widget per page, ever.

Security: the origin is pinned

The widget key is public; the host is not configurable. There is no "advanced host" field, no config key and no environment variable, because the stored host would build a first-party <script src> on every page of the site - i.e. site-wide stored XSS if it could be influenced. ChatixyKey::sanitizeHost() accepts only an https origin whose host is chatixy.com or a subdomain of it, and returns the canonical origin for anything else. The pattern is anchored at both ends, so evilchatixy.com, chatixy.com.evil.com, chatixy.com@evil.example and http://chatixy.com are all rejected.

Support

Docs and account: https://chatixy.com
Email: support@chatixy.com

MIT licensed. See LICENSE.

chatixy / statamic-chatixy

Maintainers

Package info

Statistics

Security