Chat & widget

Publishable keys

Browser-safe keys (pk_live_…) that let the chat widget talk to one assistant from allow-listed domains. Manage them per assistant. Unlike API keys, publishable keys are meant to ship in your website's HTML.

GET/agents/{id}/publishable-keys chat:read

List publishable keys

Active publishable keys for an assistant (the pk_live_ value is included — it isn't a secret).

Path parameters

id*

uuid

Assistant id.

bash

curl https://api.bolchoai.in/v1/agents/$ID/publishable-keys \
  -H "Authorization: Bearer $BOLCHO_API_KEY"

Response

json

[ { "id": "…", "name": "Website", "publicKey": "pk_live_…", "allowedOrigins": ["https://acme.com"], "enabled": true, "rateLimitPerMin": 60 } ]

POST/agents/{id}/publishable-keys chat:write

Create publishable key

Mint a new publishable key. The pk_live_ value is returned so you can embed it.

Path parameters

id*

uuid

Assistant id.

Body

name	string	Label (max 80).
allowedOrigins	string[]	Domain allow-list; empty [] allows any origin.

bash

curl -X POST https://api.bolchoai.in/v1/agents/$ID/publishable-keys \
  -H "Authorization: Bearer $BOLCHO_API_KEY" \
  -H "Content-Type: application/json" \
  -d '{
  "name": "string",
  "allowedOrigins": [
    "..."
  ]
}'

Response

json

{ "id": "…", "name": "Website", "publicKey": "pk_live_…", "allowedOrigins": ["https://acme.com"], "enabled": true }

POST/agents/{id}/publishable-keys/{keyId} chat:write

Update publishable key

Change the domain allow-list or enable/disable the key.

Path parameters

id*	uuid	Assistant id.
keyId*	uuid	Publishable key id.

Body

allowedOrigins	string[]	New domain allow-list.
enabled	boolean	Enable or disable the key.

bash

curl -X POST https://api.bolchoai.in/v1/agents/$ID/publishable-keys/$KEYID \
  -H "Authorization: Bearer $BOLCHO_API_KEY" \
  -H "Content-Type: application/json" \
  -d '{
  "allowedOrigins": [
    "..."
  ],
  "enabled": true
}'

Response

json

{ "ok": true }

DELETE/agents/{id}/publishable-keys/{keyId} chat:write

Revoke publishable key

Permanently revoke a publishable key.

Path parameters

id*	uuid	Assistant id.
keyId*	uuid	Publishable key id.

bash

curl -X DELETE https://api.bolchoai.in/v1/agents/$ID/publishable-keys/$KEYID \
  -H "Authorization: Bearer $BOLCHO_API_KEY"

Response

json

{ "ok": true }