Concepts
Authorization
Which token to send, where it comes from, and what it lets you do.
Tokens
Send a token in the Authorization header of every request. There are two kinds, one for each side of a chat, and they can’t stand in for each other.
| Token | Who uses it | Where it comes from |
|---|---|---|
mlcb_ bot token | A bot or an integration working chats: the Agent Chat API and the Configuration API | An admin adds a chatbot in Team, Chatbots, and copies the token. It is shown once. A new token revokes the old one at once. |
mlcc_ visitor token | A visitor’s chat window: the Customer Chat API | Get an access token. It lasts 8 hours; ask again when a call answers 401. |
Calling the API as a bot
A bot token authenticates the request as the bot. The bot sees only the chats assigned to it; any other chat answers not_found. Keep the token in your secret store, never in code or in a browser.
curl -X POST 'https://app.staging.mlive.chat/v1/configuration/action/get_agent' \
-H "Authorization: Bearer $MLC_BOT_TOKEN" \
-H 'Content-Type: application/json' -d '{}'Calling the API as a visitor
The chat window first exchanges the visitor’s long-lived identity for an 8-hour access token with Get an access token, then sends it on every other Customer API call.
The WebSocket
A socket opens with a one-time ticket that lasts 30 seconds, not with the token itself: get one with Get a WebSocket ticket (visitors: the visitor’s ticket). See Realtime.
Managing webhooks
Admins of your organization, from a signed-in session in the mlivechat app; a bot token can’t call it. Most teams use Settings, Webhooks instead. See Webhooks.