C.I.I. certified: recover up to 20% of your project
AI assistant for industry
Toloxa

Making an AI assistant embeddable on B2B customer websites

Iframe
Cross-domain embed
2 tokens
Secure access
E2E
Tested journey

From standalone application to embeddable module

Toloxa already has an AI assistant with a React/Vite interface, a Python back end and bidirectional audio. The engagement makes this experience embeddable on B2B customer websites without exposing access credentials or rebuilding the existing application.

Embed constraints

Work across domains

Adapt the interface to an iframe, define CSP policies and explicitly manage browser microphone permissions.

Protect anonymous access

Allow conversations without an account while preventing an integration key from being reused on an unauthorized domain.

Stay simple to integrate

Give customer technical teams a short snippet, understandable errors and actionable documentation.

Three work packages to isolate risk

Baseline security comes before the JavaScript loader and branding, so each layer can be tested before the next one is added.

1

Adapt the interface

Create an anonymous iframe mode and remove account screens without changing the conversation core.

2

Secure the session

Combine a durable integration key, a short-lived token and an allowed-domain list.

3

Simplify integration

Build a loader that retrieves the session and injects the iframe without putting the token in the URL.

4

Test and customize

Cover the journey end to end, then apply customer-specific logos, colors and messages.

From existing product to distributable component

A standalone application

  • An interface with account and history screens
  • An assistant accessed from its own domain
  • Bidirectional audio already in place

A module prepared for B2B customers

  • Anonymous sessions bound to the customer domain
  • Loader and iframe integration
  • Per-tenant visual configuration

A secure, configurable B2B module

Cross-domain iframe

An embedded mode that keeps the existing device, level and conversation journey.

Tokens and domain binding

An integration key exchanged for a short session that only works from authorized domains.

Copy-ready loader

A JavaScript loader and integration guide that reduce the work required from customer teams.

Visible errors and quotas

Dedicated feedback for exhausted quotas, rejected domains, lost connections or denied microphone access.

Per-tenant branding

Logo, primary colors, assistant name and welcome messages applied when the iframe loads.

Stack technique

ReactViteTailwind CSSi18nextPythonWebSocketSTTTTS

Ready to launch your project?

30 minutes to understand your needs and give you a clear roadmap. No commitment.

Your project deserves foundations that measure up.

In one call, we tell you what's feasible, at what price, and in what timeframe. With full transparency.

Web development, automation & AI agency

[email protected]
Newsletter

Get our tech and business tips delivered straight to your inbox.

Follow us
Crédit d'Impôt Innovation - PeakLab agréé CII