How to add an AI agent to your website

• An agent with clear instructions and only the tools a stranger on your website should reach.
• A decision about who may use it: anyone, or only visitors who are signed in to your site.
• The domains the chat will appear on, including any staging site.
• A daily spending limit you are comfortable with.

In MyDeepAgents it takes five steps:

1. 1Build the agent in the console, try it in the test chat, and publish it.
2. 2Create a widget for the agent and set how it looks: colours for light and dark mode, the launcher’s position and icon, a greeting and up to six suggested questions.
3. 3List the domains it may run on, up to 50. The chat only loads inside those sites, and calls from anywhere else are refused.
4. 4Copy the embed line from the widget’s Install panel and paste it into your pages, just before the closing </body> tag.
5. 5Test with a staging key, which answers from the agent’s staging version and marks its runs as tests. Then switch to the live key.

The embed line looks like this, with your own key:

<script async src="https://widgets.mydeepagents.com/w.js" data-key="mda_pub_…"></script>

The async attribute means the browser does not wait for the script before showing your page. If you would rather not use a floating launcher, the same key can show the chat inside a block of your page with an <mda-widget> element, open it as a hosted page with its own address, or drive your own chat design through the widget’s API.

By default visitors are anonymous. When the agent needs to know who it is talking to, for example to look up their orders, you can make sign-in optional or required.

Your own server signs a short token for the signed-in visitor with the widget’s secret, and your page passes it to the widget. In MyDeepAgents the token is a JWT signed with HMAC SHA-256, it must name the visitor, and it may live for at most 10 minutes. The secret is shown once, and it stays on your server: it never goes into the page.

You can also let signed-in visitors come back to their last conversation within 72 hours, and pick up earlier chats from a list.

The key in the embed line starts with mda_pub_ and is not a secret: anyone can read it in your page’s source. The protection comes from the rules around it.

• Domains: the chat runs only on the sites you listed, and live keys never work on localhost.
• A daily spend cap per widget, $50 a day unless you change it.
• Rate limits on messages per conversation and per network address, and on new conversations.
• Size limits: 4,000 characters a message and 200 messages a conversation. A conversation ends after 15 minutes without a message, or after 8 hours.

Each answer is also an ordinary agent run, so the agent’s own limits on steps, time and cost apply to every message.

• Type questions, or pick one of the suggested questions.
• Attach files, when you turn uploads on: PDF, images, text and CSV, up to 10 MB each unless you change it.
• Talk instead of type, when you turn voice on: with the browser’s own speech features, or with a speech provider for dictation, read-aloud and hands-free conversation.
• Stop an answer that is still being written.

When the agent reaches an action that needs a person’s approval, the visitor sees a short message saying the team is checking the request, while someone on your team decides in the console. See human-in-the-loop approvals.

• Never put secrets in the agent’s instructions. Instructions can leak through clever questions; credentials belong in connections.
• Give the agent only the tools a visitor should be able to trigger, and put approvals on anything that changes data.
• Tell visitors they are talking to an AI. The widget always shows an AI notice, and you can add a consent message.
• Read real conversations in the first weeks, and adjust the instructions.