Add the Product Agent to your product

Adding the Product Agent takes one endpoint on your server and one snippet in your page. Your secret key never reaches the browser.

You need the Admin role. In the Product Agent, open Integration and select Start integration.

Step 1: Add your app domain#

Under Domains, enter the addresses where the Product Agent may run, one per line, and select Create integration.

• You need at least one specific domain. A wildcard on its own is not enough.
• localhost and 127.0.0.1 always work for development, on any port. You do not need to add them.
• A domain can be connected to one Pluno workspace only. If yours is already taken, contact hi@pluno.ai.

If you add several domains, choose a Context domain. Local development then behaves like that domain.

Step 2: Save your access key#

Select Copy credentials and store both values in your server's secrets:

PLUNO_PRODUCT_AGENT_PUBLIC_KEY=pa_pk_…
PLUNO_PRODUCT_AGENT_SECRET_KEY=pa_sk_…

If you lose the secret, select Create access key under Access keys for a new one. The old secret keeps working until you select Revoke, so you can switch over without downtime.

Step 3: Add Pluno to your product#

Select View manual setup guide for ready-to-copy code in JavaScript and Python, or Copy coding-agent instructions to hand the task to your coding assistant.

Add a token endpoint on your server#

Your browser code never talks to Pluno with the secret. Instead, your server asks Pluno for a short-lived token and passes it to the page.

1. Create an endpoint on your server, for example /api/pluno-product-agent-token. Only signed-in users should be able to call it.
2. In it, call POST /api/product-agent/embed/token on Pluno with your public_key, your secret_key, the page's origin, and metadata about the user.
3. Return the token from Pluno's response.

Tokens last 15 minutes, and the widget fetches a new one by itself.

Identify your users#

Whatever you send in metadata tells Pluno who the user is. Take these values from the user's signed-in session on your server, never from data the browser sends you. Then the browser cannot change them.

Add the snippet to your page#

Paste the snippet into every page where the Product Agent should appear. Nothing needs to be installed.

<script type="module"
  src="https://app.pluno.ai/product-agent/product-agent-widget.js"
  data-pluno-token-endpoint="/api/pluno-product-agent-token"
  data-pluno-launcher-label="Ask for anything..."
  data-pluno-accent-color="#7c3aed"></script>

If you bundle your front end, you can use the npm package instead: npm install @pluno/product-agent-web, then PlunoProductAgent.init({ tokenProvider }).

Check the connection#

Open your product, send a message through the widget, then select Check connection on the Integration page. The panel changes to Pluno is connected.

What the widget reads from the page#

Tell your security team what the Product Agent collects from the user's browser:

• The page. Its address and title, the visible text, any selected text, open dialogs, and an outline of the page's elements. You can switch this off with the SDK option capturePageContent: false.
• Your product's API calls. The requests the page makes to your backend, with their responses. Pluno uses them to understand the user's data and setup. File uploads and sign-in requests are not recorded.
• Attachments the user adds: PDFs and images.

Before captured API data leaves the browser, values stored under names such as password, token, secret, cookie or authorization are masked.

Pluno acts as the signed-in user, so it can read and do exactly what that user can. Your product's own permissions are what limit it.

If something goes wrong#