---
title: Web widget
description: Configure allowed origins and create secure browser voice sessions.
---

import Endpoint from '../../../components/Endpoint.astro';

<Endpoint method="GET" path="/api/developer/v1/widget/config" title="Read widget configuration" />
<Endpoint method="PUT" path="/api/developer/v1/widget/config" title="Update origins and limits" />
<Endpoint method="POST" path="/api/developer/v1/widget/session" title="Create a short-lived session" />
<Endpoint method="GET" path="/api/developer/v1/widget/embed-snippet" title="Get the embed snippet" />

Widget configuration includes allowed origins, session duration from 1–60 minutes (default 5), and an optional daily maximum. Session creation accepts `agent_id`, `origin`, and optional `force_audio`.

Never put the Developer API key in the browser. Your server creates the widget session, then returns only the short-lived session data to the page. Match allowed origins exactly and include production HTTPS origins before release.