#Publishable tokens and the widget
| Method | Path | Body or result |
|---|---|---|
| GET | /publishable_tokens | List active developer-created tokens: prefix, environment, label, allowed_origins |
| POST | /publishable_tokens | { "environment": "live", "label": "website", "allowed_origins": ["https://acme.com"] }; returns the full token once |
| PATCH | /publishable_tokens/:prefix | { "allowed_origins": [...] }; replaces the token's allowed origins |
| DELETE | /publishable_tokens/:prefix | Revoke a token |
| GET | /widget | Widget configuration, allowed origins, agent availability, tokens, and links to the inbox |
A publishable token is for live or preview; omission defaults to live. A token works only from its own
allowed_origins, plus Vatio's own pages and the
app builders; an origin that is not
scheme://host[:port], ios-app://BUNDLE_ID or android-app://PACKAGE_NAME
answers 422. The managed token
in the inbox's install snippet is not listed here; its origins are edited in
the tokens section of Channels → Web widget in the inbox.
GET /widget is read-only. Its allowed_origins is every origin some active
token accepts, each token in publishable_tokens carries its own list, and
brand_url and tokens_url link to Channels → Web widget in the inbox,
where the widget's look and the tokens' origins are edited.