Overview

ATG Embedded runs inside an isolated iframe hosted on app.askthisguy.com, ensuring data privacy, robust security, and effortless updates. 🔒

Integration modes

Mode	Typical Use Case	Authentication to scope the session	Requires Backend
Mode 1 - Public	Website FAQ, lead gen, simple SaaS help without per-user context	None	No
Mode 2 -Connected	Auth'd SaaS, contextual support, automations	Server-signed JWT with short TTL	✅ Yes

Key concepts 🔑

For both modes

Widget (`widget.js`) 🧩

A lightweight script that ATG provides and that you embed in your site.

It injects an iframe pointing to https://app.askthisguy.com, creates the chat launcher via Shadow DOM, and communicates with the iframe using postMessage.

Iframe isolation 🛡️

All chat UI and data live inside a cross-origin iframe (app.askthisguy.com) under the browser's Same-Origin Policy:

Your page cannot read ATG tokens
ATG cannot access your cookies or scripts

Shadow DOM 👻

Prevents CSS/JS collisions with your site.

Access token 🎫

To maintan the chat sessions with users, ATG ensures that the iframe holds a short-lived, DPoP-bound bearer token in memory and sends it as Authorization: DPoP \\<access\\> with the right header.

This mechanism allows to maintain a session on browser like Safari where 3rd party cookies and partitionned cookies would get blocked.