Public Chat

A public share needs no backend code. Visitors chat without logging in; each browser gets its own anonymous identity and sees its history again on the next visit.

In all examples replace https://rag.example.com with your Ragty base URL and shr_XXXXXXXXXXXXXXXXXXXXXXXX with your share ID.

Option A: Web component (recommended)

Embed the web component

Load the component once per page:
<script type="module" src="https://rag.example.com/embed-assets/v1/m8ty-chat.js" crossorigin="anonymous"></script>
Place the element where the chat should appear and give it a height:
<m8ty-chat share="shr_XXXXXXXXXXXXXXXXXXXXXXXX" locale="de" theme="auto" style="display:block;height:600px"></m8ty-chat>
Open the page from one of the allowed origins. The greeting of the chat appears and visitors can start asking questions.

The snippet in the Ragty integration guide additionally contains an integrity="sha384-…" attribute. It guarantees that exactly the reviewed version of the script runs on your page. After a Ragty update the hash changes: copy the new snippet, or omit integrity if you prefer automatic updates.

Option B: iframe

<iframe src="https://rag.example.com/embed/shr_XXXXXXXXXXXXXXXXXXXXXXXX?locale=de&amp;theme=auto"
        title="Chat"
        allow="clipboard-write"
        referrerpolicy="strict-origin"
        style="width:100%;height:600px;border:0"></iframe>

Query parameter	Values	Default
`locale`	`de`, `en`	Browser language
`theme`	`light`, `dark`, `auto`	`auto`

The frame only loads on the allowed origins; on any other site the browser refuses to display it.

Java server-side templates (Velocity)

If your pages are rendered with Apache Velocity, keep the share configuration in your Java code and render the snippet from a template. Put the values into the Velocity context once per request:

import org.apache.velocity.VelocityContext;
import org.apache.velocity.tools.generic.EscapeTool;

VelocityContext context = new VelocityContext();
context.put("esc", new EscapeTool());               // Velocity Tools: HTML/URL escaping
context.put("ragtyUrl", "https://rag.example.com"); // from your configuration
context.put("shareId", "shr_XXXXXXXXXXXXXXXXXXXXXXXX");
context.put("locale", "de");
context.put("cspNonce", cspNonce);                  // only if your CSP uses nonces: same value as in the header
template.merge(context, writer);

## m8ty-chat-public.vm
<script type="module" nonce="$esc.html($cspNonce)"
        src="$esc.html($ragtyUrl)/embed-assets/v1/m8ty-chat.js"
        crossorigin="anonymous"></script>

<m8ty-chat share="$esc.html($shareId)"
           locale="$esc.html($locale)"
           theme="auto"
           style="display:block;height:600px"></m8ty-chat>

## m8ty-chat-public-iframe.vm
<iframe src="$esc.html($ragtyUrl)/embed/$esc.url($shareId)?locale=$esc.url($locale)&amp;theme=auto"
        title="Chat"
        allow="clipboard-write"
        referrerpolicy="strict-origin"
        style="width:100%;height:600px;border:0"></iframe>

Always output values through $esc.html(…)/$esc.url(…), even if they come from your own configuration.
Do not add user data ($user, e-mail, customer number) to a public template — a public chat never receives a user.
Remove nonce="…" if your CSP does not use nonces.

Content Security Policy

If your page sends a Content-Security-Policy header, add the Ragty origin:

Directive	Needed for
`script-src https://rag.example.com`	Web component
`connect-src https://rag.example.com`	Web component (API calls)
`frame-src https://rag.example.com`	iframe

The component itself needs no 'unsafe-inline' and no 'unsafe-eval'; it is compatible with Trusted Types.

How the anonymous identity works

On first use Ragty sets a cookie on the Ragty domain: HttpOnly; Secure; SameSite=None; Partitioned. It is bound to your site, invisible to any JavaScript (including yours) and renewed on every visit.
Clearing cookies, using a private window or switching device starts a new, empty chat. Browsers that block partitioned third-party cookies start a new chat on every page load.
History is deleted automatically after the retention period of the share.

Verify the integration

Open the page on an allowed origin and ask a question — the answer streams in and cited sources are listed below it.
Reload the page — the previous conversation is shown again.
Open the same page from a non-allowed origin (for example a local test page) — the chat must not work (iframe blank, CORS error in the console for the web component).

12 November 2026