VoIP Widget

What is the VoIP Widget?

The VoIP Widget is a small embeddable call button you add to your website with a single line of code. When a visitor clicks it, a floating call panel appears. They click "Call Now," allow microphone access, and are instantly connected to your BLEUM AI agent through their browser — no phone call, no app download.

After the call ends, the panel shows a post-call summary including the call duration, number of turns, sentiment trajectory, average response time, and an AI-generated summary of what was discussed. It's a complete support experience without the customer ever leaving your page.

What the Widget Includes

Setting Up the Widget

Step 1 — Create a widget in your admin

Navigate to Phone Numbers → Call Widgets in your admin (create a VoIP endpoint first with Create VoIP Endpoint). Click Create Widget and configure:

• Name — What the widget header shows to visitors (e.g. "BLEUM Support").
• VoIP Endpoint — Which of your VoIP lines the widget calls. This determines which Welcome flow and procedures handle the call.
• Allowed Domains — The website domains where this widget is permitted to load. Requests from unlisted domains are blocked for security.

Step 2 — Copy the embed code

After saving, click Copy Snippet on the widget's card. It looks like this:

<script src="https://api.bleum.ai/public/widget/bleum-widget.js"
  data-publishable-key="bleum_pk_YOUR_KEY_HERE"
  defer></script>

Step 3 — Add it to your website

Paste the snippet before the closing </body> tag on any page where you want the widget to appear. No other configuration is needed — the widget loads automatically and floats in the corner set by its Button Position (bottom-right by default).

How It Works for Visitors

Post-Call Summary Details

After every widget call, visitors see a summary panel with four metrics and an AI-written summary:

The AI summary is a two-to-three-sentence recap of the conversation. Hover over any metric label to see a tooltip explaining what it measures.

Domain Security

Each widget has an Allowed Domains list. The button shows wherever the snippet is pasted, but a browser on a domain outside that list cannot place a call. This prevents your widget from being used on unauthorized sites. Always add the exact domains where you plan to embed the widget — including subdomains if needed (e.g. both yoursite.com and www.yoursite.com). A request that names no website at all is refused too: browsers always name the page a call comes from, so only scripts outside a browser are affected.

Secure widgets (JWT)

For a widget only signed-in visitors should use, set its Security Tier to Secure (JWT required). Before each call the widget asks your own server for a short-lived token, signed with a key only you hold, and BLEUM opens the call only with a valid one, used once.

Step 1 — Create a signing key

In Phone Numbers → Call Widgets → Signing keys (admins only), click Create key. The private key is shown once: copy it to your server's secrets. BLEUM keeps only the public half. A widget cannot be set to JWT until a key exists.

Step 2 — Sign a token on your server

An endpoint on your site checks your own sign-in and answers { "token": "…" }. The token is an ES256 JWT with the key's id as kid, the widget's publishable key as aud, a unique jti, and at most five minutes of life. In Node, with the jsonwebtoken package:

jwt.sign({ aud: 'bleum_pk_YOUR_KEY_HERE', jti: crypto.randomUUID(), sub: user.id },
         privateKeyPem, { algorithm: 'ES256', keyid: 'wk_YOUR_KEY_ID', expiresIn: 120 });

sub is optional (your own reference for the visitor; BLEUM checks it and does not store it).

Step 3 — Point the widget at it

<script src="https://api.bleum.ai/public/widget/bleum-widget.js"
  data-publishable-key="bleum_pk_YOUR_KEY_HERE"
  data-auth-url="/your/token/endpoint"
  defer></script>

The widget calls that path with a POST that carries the visitor's cookies. A single-page app can instead set window.BleumWidget = { getAuthToken: async () => token } before the widget loads. With neither, a secure widget shows no button.

Rotating a key: create a second key, put it on your server, then retire the first. You can hold two active keys; the last one cannot be retired while a widget is set to JWT.

Browser Requirements

The widget uses WebRTC for the call connection and the browser's microphone API. It works best on:

• Chrome (recommended)
• Edge
• Firefox

Safari has partial support but may have microphone permission issues on some versions. The widget will not work on browsers that block WebRTC or on managed corporate devices with restrictive network policies.

Common Questions