Keys and tokens

The public keys the website embeds use, and the OAuth access tokens your servers use for the API.

Subcontext uses public keys for embeds that run on your web pages, and access tokens for the API.

Public keys and ids#

Most embeds use a key or id that goes in your page. These aren't secret, and anyone who views your page's source can see them. Subcontext checks where each one is used, against the websites you've approved or a setting in the dashboard.

Embed What it uses Where you find it
Webchat Your agent's id Agents, your agent, Channels, Web
Form guide Your agent's id The same place as the webchat
Lead form The form's key (lfk_...) CRM, Lead forms, the form, Install tab
Quote form The quote form's key (qfk_...), or a token from your server The quote form, on its campaign
WebMCP The integration's key (wmk_...) Organisation, Agent access, Manage WebMCP tools
Nurture The widget key (nwk_...), and a pass your server signs Email hello@subcontext.com and Subcontext sets it up with you

Each embed's guide says where to find its key and which websites it works on.

Access tokens#

Your servers call the Subcontext API with an access token, which lasts two hours. Your code requests one with the client id and client secret of an API application you create in the dashboard under Integrations, API applications. This is the standard OAuth "client credentials" flow:

sh 
curl -X POST https://subcontext.com/oauth/token \
  -d grant_type=client_credentials \
  -d client_id=YOUR_CLIENT_ID \
  -d client_secret=YOUR_CLIENT_SECRET \
  -d "scope=read write" \
  -d resource=https://subcontext.com/api/v1

Then send the token on each request:

sh 
curl https://subcontext.com/api/v1/products \
  -H "Authorization: Bearer YOUR_ACCESS_TOKEN"
  • Keep the client secret on your server. Don't put it in a web page. When a page needs a token (the quote form can use one), your server requests it and passes only the token to the page.
  • Scopes say what a token may do: read, write, crm and outcomes. Give each application only what it needs.
  • Server-only or browser. An application with no allowed websites works only from your servers. An application with allowed websites works only from pages on those websites. You'll usually want one of each.

Access tokens covers this step by step, with examples in Node, Python, PHP, C# and shell.

Connecting an AI assistant#

AI assistants such as Claude or ChatGPT connect to Subcontext with a different sign-in, which a person in your firm approves. See AI assistants.

Stuck, or something missing?

Get in touch and a person on the team will help.

Contact us