Website messenger

Install the messenger with a 2 KB loader script on your own origin.

The messenger is a 2 KB loader, a shadow-DOM launcher and an iframe app. The first load is 110 KB gzipped. It runs on your own origin, so there are no tracking pixels and no third-party calls.

Install

Paste this tag in the <head> of every page. Replace <workspace-slug> with your workspace's slug, and <your-host> with the origin that serves the loader. Until a host domain is added to the workspace, the messenger loads nowhere, so the tag alone does not open a window.

html

<script data-workspace="<workspace-slug>" src="https://<your-host>/loader.js"></script>

The loader is a classic script, so document.currentScript tells it where its own chunks live. It loads the launcher lazily, after load or as soon as a boot command names a workspace.

Optional attributes

Attribute	What it does
`data-workspace`	The workspace slug. Without it, the loader logs a warning and does nothing.
`data-messenger-origin`	Where the messenger frame document is served, when that is not the loader's own origin.
`data-api-origin`	Where the messenger API routes live, when they are not on the messenger origin.
`nonce`	The CSP nonce to put on the launcher script, when your policy needs one.

The window.fikadesk API

The loader exposes a small command queue so you can boot it from a tag manager or a single-page app long after the load event fired. Commands run in the order you send them.

html

<script>
  window.fikadesk = window.fikadesk || [];
  window.fikadesk("boot", { workspace: "acme" });
</script>

fikadesk("boot", { workspace }) names the workspace and starts the launcher.
fikadesk("on", { event, handler }) subscribes to an event; "off" unsubscribes.
Anything else is queued and replayed once the launcher is up.

Serving the loader

In the single compose profile, Caddy serves loader.js beside the api. Point the tag's src at that host. If you split the frame and the api across origins, set data-messenger-origin and data-api-origin and let Caddy's CORS answers cover the cross-origin fetches.