Guides & reference

Put the bot anywhere. Connect it to everything.

Add the chat to any website in two minutes, drive it from your own buttons, and send every lead, conversation and call into your CRM with a REST API and signed webhooks.

🌐

Install on a website

16 platforms, step by step

🎛️

Control it from your page

Open, ask, call from your buttons

🔌

REST API

26 endpoints for leads, chats, calls

⚡

Webhooks

Real-time events, signed

1. Put the bot on your website

Get your code from Dashboard → Website chat → Copy code. It already has your key in it. It looks like this:

<script>
  (function(w,d){
    w.ProphBotConfig = { apiKey: "YOUR_PUBLIC_KEY", baseUrl: "https://prophecius.in" };
    var s=d.createElement('script'); s.src=w.ProphBotConfig.baseUrl+"/widget/widget.js"; s.async=true;
    (d.body||d.head||d.documentElement).appendChild(s);
  })(window, document);
</script>

Paste it once, on every page (a shared footer is easiest). It loads after your page, so it never slows it down. Then use Dashboard → Website chat → Check my site to confirm it is live.

Any website (HTML)⌄

Open the HTML of every page, or the shared footer file.
Paste the code just before the closing </body> tag.
Save and upload. The chat bubble appears in the bottom corner.

WordPress⌄

Plugins → Add New → search “WPCode” (free) → Install → Activate.
Code Snippets → Header & Footer → paste the code in “Footer”.
Save Changes.
Without a plugin: Appearance → Theme File Editor → footer.php → paste above </body>. (A theme update can undo this, so the plugin is safer.)

Elementor⌄

Elementor → Custom Code → Add New.
Paste the code, set Location to “</body> - End”.
Publish, and choose “Entire Site” as the condition.

Shopify⌄

Online Store → Themes → ⋯ next to your live theme → Edit code.
Open layout/theme.liquid and find </body> near the bottom.
Paste the code just above it and Save.

Wix⌄

Settings → Custom Code (under Advanced) → + Add Custom Code.
Paste the code, choose “All pages” and place it in “Body - end”.
Apply, then Publish the site. (Custom code needs a Wix premium plan with a connected domain.)

Squarespace⌄

Settings → Advanced → Code Injection.
Paste the code into “Footer”.
Save. (Code Injection needs a Business plan or higher.)

Webflow⌄

Site settings → Custom code.
Paste the code into “Footer code”.
Save, then Publish.

GoDaddy Website Builder⌄

Edit site → Add section → search “HTML” → add the HTML section to the footer.
Paste the code and click Done.
Publish.

Framer⌄

Site settings → General → Custom Code.
Paste the code in “End of <body> tag”.
Publish.

Zoho Sites⌄

Settings → SEO / Header & Footer code (or Page settings → Footer code).
Paste the code in the footer section.
Publish.

Blogger⌄

Theme → ⋮ → Edit HTML.
Find </body> and paste the code just above it.
Save.

Google Tag Manager⌄

Tags → New → Tag type “Custom HTML”.
Paste the code. Trigger: “All Pages”.
Save, then Submit and Publish the container.

React⌄

Load it once, when the app starts.

import { useEffect } from 'react';

export function ProphBot() {
  useEffect(() => {
    if (document.getElementById('prophbot')) return;
    (window as any).ProphBotConfig = { apiKey: 'YOUR_PUBLIC_KEY', baseUrl: 'https://prophecius.in' };
    const s = document.createElement('script');
    s.id = 'prophbot'; s.src = 'https://prophecius.in/widget/widget.js'; s.async = true;
    document.body.appendChild(s);
  }, []);
  return null;
}

Next.js⌄

Add it to app/layout.tsx (or pages/_app.tsx).

import Script from 'next/script';

// inside <body>, after {children}:
<Script id="prophbot-config" strategy="afterInteractive">
  {`window.ProphBotConfig = { apiKey: "YOUR_PUBLIC_KEY", baseUrl: "https://prophecius.in" };`}
</Script>
<Script src="https://prophecius.in/widget/widget.js" strategy="afterInteractive" />

Vue, Angular, Svelte⌄

Paste the code into public/index.html (or src/index.html), just before </body>.
Rebuild and deploy.

Mobile app (Android, iOS, Flutter)⌄

Host a one-line page with the code on your site, for example yoursite.com/chat.
Open that page in a WebView. Allow the microphone in the WebView if you want voice calls.
Or skip the widget and use POST /api/v1/chat from your app for a fully native chat screen.

Only on some pages

Wrap the code so it only loads where you want it, for example only on pages under /products:

<script>
  if (location.pathname.startsWith('/products')) {
    /* paste the inside of your code here */
  }
</script>

It doesn't show?

Clear your site's cache (WP Rocket, LiteSpeed, Cloudflare) and your browser's, then reload.
The bot must be switched on in Dashboard → My bots.
A strict Content-Security-Policy must allow https://prophecius.in in script-src and connect-src.
Voice calls need https and Chrome, Edge or Safari. The microphone permission is asked on the first call.

2. Control it from your page

Once the code is on the page, window.ProphBot lets your own buttons drive the chat. Calls made before it has loaded are remembered and run as soon as it is ready.

<button onclick="ProphBot.open()">Chat with us</button>
<button onclick="ProphBot.ask('What does delivery cost?')">Delivery prices</button>
<button onclick="ProphBot.call()">Talk to us now</button>

<script>
  ProphBot.close();          // close the chat
  ProphBot.toggle();         // open if closed, close if open
  ProphBot.isOpen();         // true or false
  window.addEventListener('prophbot:ready', () => { /* the widget has loaded */ });
  prophVerifyPhone('+919876543210');  // ask the visitor to confirm their number
</script>

3. REST API

For CRMs, back offices and apps. Base address https://prophecius.in/api/v1. Every call needs your account API key (Dashboard → Developers / API; plans with API access):

Authorization: Bearer pb_YOUR_ACCOUNT_KEY

JSON in, JSON out. Errors come back as { "error": "..." } with a clear message and the usual status codes.

Paging. Lists are newest first. Pass next_before from one page as before to get the next.

Limits. 120 requests a minute per account. Keep the key on your server, never in a web page.

Import everything into Postman or Insomnia, or generate a client in any language, from the OpenAPI file: https://prophecius.in/api/v1/openapi.json

Account Bots Leads Customers Conversations Chat Calls Forms Knowledge Follow-ups Webhooks

Account

GET/api/v1/me· Your account and plan

Checks the key works, and returns the plan and its limits.

curl "https://prophecius.in/api/v1/me" \
  -H "Authorization: Bearer pb_YOUR_ACCOUNT_KEY"

Bots

GET/api/v1/bots· List your bots

`public_key` is the key used by the website widget and the chat endpoint.

curl "https://prophecius.in/api/v1/bots" \
  -H "Authorization: Bearer pb_YOUR_ACCOUNT_KEY"

GET/api/v1/bots/{bot_id}· One bot

bot_id*

integer · path

The bot

curl "https://prophecius.in/api/v1/bots/123" \
  -H "Authorization: Bearer pb_YOUR_ACCOUNT_KEY"

Leads

GET/api/v1/leads· List leads

People who want to buy or book: from chats, forms, calls and the API. Newest first.

status	string · query	new, contacted, won or lost
bot_id	integer · query	Only this bot
since	string · query	ISO date: only leads created on or after it
updated_since	string · query	ISO date: only leads changed on or after it. Handy for two-way CRM sync.
limit	integer · query	How many to return, 1 to 200. Default 50.
before	integer · query	Paging: return items older than this id. Use `next_before` from the previous page.

curl "https://prophecius.in/api/v1/leads" \
  -H "Authorization: Bearer pb_YOUR_ACCOUNT_KEY"

GET/api/v1/leads/{lead_id}· One lead

lead_id*

integer · path

The lead

curl "https://prophecius.in/api/v1/leads/123" \
  -H "Authorization: Bearer pb_YOUR_ACCOUNT_KEY"

POST/api/v1/leads· Create a lead

For leads that start outside the bot (your CRM, an ad form). You get the usual alerts, and `lead.created` fires.

bot_id*	integer · body	Which bot it belongs to
name	string · body	Their name
phone	string · body	Phone or WhatsApp number
email	string · body	Email address
company	string · body	Company
message	string · body	What they want
source	string · body	Where it came from, e.g. "crm" or "facebook_ads". Default "api".

curl -X POST "https://prophecius.in/api/v1/leads" \
  -H "Authorization: Bearer pb_YOUR_ACCOUNT_KEY" \
  -H "Content-Type: application/json" \
  -d '{"bot_id":12,"name":"Priya Sharma","phone":"+91 98765 43210","message":"Wants a birthday cake for Saturday","source":"crm"}'

PATCH/api/v1/leads/{lead_id}· Update a lead

Change its status or details, for example when the deal moves in your CRM. `lead.updated` fires.

lead_id*	integer · path	The lead
status	string · body	new, contacted, won or lost
notes	string · body	Your notes
name	string · body	Name
phone	string · body	Phone
email	string · body	Email
company	string · body	Company

curl -X PATCH "https://prophecius.in/api/v1/leads/123" \
  -H "Authorization: Bearer pb_YOUR_ACCOUNT_KEY" \
  -H "Content-Type: application/json" \
  -d '{"status":"won","notes":"Paid in full, delivery Saturday 5 pm"}'

Customers

GET/api/v1/customers· List customers

Everyone who has talked to your bots, on any channel. Newest activity first.

search	string · query	Matches name, phone or email
bot_id	integer · query	Only this bot
channel	string · query	website, whatsapp, telegram or api
active_since	string · query	ISO date: seen on or after it
limit	integer · query	How many to return, 1 to 200. Default 50.
before	integer · query	Paging: return items older than this id. Use `next_before` from the previous page.

curl "https://prophecius.in/api/v1/customers" \
  -H "Authorization: Bearer pb_YOUR_ACCOUNT_KEY"

GET/api/v1/customers/{customer_id}· One customer, with their conversations

customer_id*

integer · path

The customer

curl "https://prophecius.in/api/v1/customers/123" \
  -H "Authorization: Bearer pb_YOUR_ACCOUNT_KEY"

PATCH/api/v1/customers/{customer_id}· Update a customer

Keep names, numbers and tags in step with your CRM. `tags` replaces the whole list.

customer_id*	integer · path	The customer
name	string · body	Name
phone	string · body	Phone
email	string · body	Email
tags	string[] · body	Tags, e.g. ["vip","wholesale"]

curl -X PATCH "https://prophecius.in/api/v1/customers/123" \
  -H "Authorization: Bearer pb_YOUR_ACCOUNT_KEY" \
  -H "Content-Type: application/json" \
  -d '{"name":"Priya Sharma","tags":["vip","repeat-buyer"]}'

Conversations

GET/api/v1/conversations· List conversations

Status is open (the bot is answering), needs_you (it needs a person), human (a person is replying) or resolved.

status	string · query	open, needs_you, human or resolved
bot_id	integer · query	Only this bot
channel	string · query	website, whatsapp, telegram or api
since	string · query	ISO date: last message on or after it
limit	integer · query	How many to return, 1 to 200. Default 50.
before	integer · query	Paging: return items older than this id. Use `next_before` from the previous page.

curl "https://prophecius.in/api/v1/conversations" \
  -H "Authorization: Bearer pb_YOUR_ACCOUNT_KEY"

GET/api/v1/conversations/{conversation_id}· One conversation with its messages

Messages oldest first. `sender` is customer, bot, agent (a person) or system.

conversation_id*

integer · path

The conversation

curl "https://prophecius.in/api/v1/conversations/123" \
  -H "Authorization: Bearer pb_YOUR_ACCOUNT_KEY"

POST/api/v1/conversations/{conversation_id}/reply· Reply as a person

Sends your message to the customer on their channel and pauses the bot in this chat. The bot takes over again after 30 minutes of silence from you.

conversation_id*	integer · path	The conversation
message*	string · body	What to send

curl -X POST "https://prophecius.in/api/v1/conversations/123/reply" \
  -H "Authorization: Bearer pb_YOUR_ACCOUNT_KEY" \
  -H "Content-Type: application/json" \
  -d '{"message":"Hi Priya, your cake is confirmed for Saturday 5 pm."}'

POST/api/v1/conversations/{conversation_id}/close· Mark a conversation resolved

conversation_id*

integer · path

The conversation

curl -X POST "https://prophecius.in/api/v1/conversations/123/close" \
  -H "Authorization: Bearer pb_YOUR_ACCOUNT_KEY"

Chat

POST/api/v1/chat· Ask the bot

Put your bot inside anything: an app, a CRM screen, a kiosk. Use the same `customer_ref` for the same person and the bot remembers the conversation. Shows in your dashboard under the "api" channel.

bot_id*	integer · body	Which bot answers
customer_ref*	string · body	Your id for this person (a CRM contact id, a phone number). Up to 120 characters.
message*	string · body	What they said
name	string · body	Their name, if you know it
phone	string · body	Their phone, if you know it
email	string · body	Their email, if you know it

curl -X POST "https://prophecius.in/api/v1/chat" \
  -H "Authorization: Bearer pb_YOUR_ACCOUNT_KEY" \
  -H "Content-Type: application/json" \
  -d '{"bot_id":12,"customer_ref":"crm-contact-8812","message":"Do you deliver to Kothrud?","name":"Priya"}'

Calls

GET/api/v1/calls· Voice call log

days	integer · query	How far back, 1 to 365. Default 30.
bot_id	integer · query	Only this bot
limit	integer · query	1 to 200. Default 50.

curl "https://prophecius.in/api/v1/calls" \
  -H "Authorization: Bearer pb_YOUR_ACCOUNT_KEY"

Forms

GET/api/v1/forms· List forms

curl "https://prophecius.in/api/v1/forms" \
  -H "Authorization: Bearer pb_YOUR_ACCOUNT_KEY"

GET/api/v1/forms/{form_id}/submissions· Form submissions

form_id*	integer · path	The form
since	string · query	ISO date: submitted on or after it
limit	integer · query	How many to return, 1 to 200. Default 50.
before	integer · query	Paging: return items older than this id. Use `next_before` from the previous page.

curl "https://prophecius.in/api/v1/forms/123/submissions" \
  -H "Authorization: Bearer pb_YOUR_ACCOUNT_KEY"

Knowledge

GET/api/v1/bots/{bot_id}/knowledge· What a bot has been taught

bot_id*

integer · path

The bot

curl "https://prophecius.in/api/v1/bots/123/knowledge" \
  -H "Authorization: Bearer pb_YOUR_ACCOUNT_KEY"

POST/api/v1/bots/{bot_id}/knowledge· Teach a bot

Add a web page, some text, or a question and its answer. It is read in the background; `status` goes pending, processing, ready. Counts toward your plan's limit.

bot_id*	integer · path	The bot
type*	string · body	url, text or faq
url	string · body	For type url: the page address
title	string · body	For text: a short name
text	string · body	For type text: the text itself (up to 200,000 characters)
question	string · body	For type faq
answer	string · body	For type faq

curl -X POST "https://prophecius.in/api/v1/bots/123/knowledge" \
  -H "Authorization: Bearer pb_YOUR_ACCOUNT_KEY" \
  -H "Content-Type: application/json" \
  -d '{"type":"faq","question":"Do you deliver on Sundays?","answer":"Yes, 9 am to 6 pm, free above 1,000 rupees."}'

DELETE/api/v1/bots/{bot_id}/knowledge/{source_id}· Forget something

bot_id*	integer · path	The bot
source_id*	integer · path	The source

curl -X DELETE "https://prophecius.in/api/v1/bots/123/knowledge/123" \
  -H "Authorization: Bearer pb_YOUR_ACCOUNT_KEY"

Follow-ups

GET/api/v1/follow-ups· Follow-up messages

Messages the bot wrote to leads that went quiet: drafts, approved, sent, skipped.

curl "https://prophecius.in/api/v1/follow-ups" \
  -H "Authorization: Bearer pb_YOUR_ACCOUNT_KEY"

Webhooks

GET/api/v1/webhook· Your webhook settings

curl "https://prophecius.in/api/v1/webhook" \
  -H "Authorization: Bearer pb_YOUR_ACCOUNT_KEY"

PUT/api/v1/webhook· Set your webhook

Where to POST events, and which ones. Use ["*"] for everything. The response includes the signing secret; keep it safe.

url*	string · body	Your https address. Empty string turns webhooks off.
events	string[] · body	Events to send, or [""]. Default [""].

curl -X PUT "https://prophecius.in/api/v1/webhook" \
  -H "Authorization: Bearer pb_YOUR_ACCOUNT_KEY" \
  -H "Content-Type: application/json" \
  -d '{"url":"https://crm.example.com/hooks/prophecius","events":["lead.created","lead.updated","call.ended"]}'

POST/api/v1/webhook/test· Send a test event

event

string · body

Which event to imitate. Default lead.created.

curl -X POST "https://prophecius.in/api/v1/webhook/test" \
  -H "Authorization: Bearer pb_YOUR_ACCOUNT_KEY" \
  -H "Content-Type: application/json" \
  -d '{}'

POST/api/v1/webhook/rotate-secret· New signing secret

The old secret stops working at once.

curl -X POST "https://prophecius.in/api/v1/webhook/rotate-secret" \
  -H "Authorization: Bearer pb_YOUR_ACCOUNT_KEY"

4. Webhooks

Instead of asking the API every few minutes, let us tell you. Set a URL in Dashboard → Developers / API (or PUT /api/v1/webhook), pick the events, and we POST each one the moment it happens.

lead.created	A new lead: from the chat, a form, a call, or created through the API.
lead.updated	A lead changed status (new, contacted, won, lost) or its details changed.
lead.deleted	Leads were moved to the trash, or deleted for good (permanent: true).
lead.restored	Leads were brought back from the trash.
conversation.deleted	Chats were deleted for good by the owner.
customer.deleted	People were deleted for good by the owner, with their chats.
form.submitted	Someone filled in one of your bot's forms.
conversation.needs_human	A conversation or call needs a person: the bot could not help, or the customer asked for someone.
call.ended	A voice call with your bot ended. Includes length, questions asked and how it ended.

Every delivery looks like this:

POST https://your-crm.example.com/hooks/prophecius
X-Prophecius-Event: lead.created
X-Prophecius-Timestamp: 1727170000
X-Prophecius-Signature: sha256=5f2b...

{
  "id": "evt_8c1d...",
  "event": "lead.created",
  "created_at": "2026-09-24T10:15:00.000Z",
  "test": false,
  "data": { "id": 481, "bot_id": 12, "name": "Priya Sharma", "phone": "+91 98765 43210", "message": "Birthday cake for Saturday", "source": "bot_form" }
}

Check it really came from us

Compute an HMAC-SHA256 of timestamp + "." + raw body with your signing secret and compare it with the header. Reject anything older than five minutes.

// Node.js (Express): use the raw body, not the parsed JSON
const crypto = require('crypto');
app.post('/hooks/prophecius', express.raw({ type: 'application/json' }), (req, res) => {
  const ts = req.get('X-Prophecius-Timestamp');
  const expected = 'sha256=' + crypto.createHmac('sha256', process.env.PROPHECIUS_SECRET).update(ts + '.' + req.body).digest('hex');
  const ok = crypto.timingSafeEqual(Buffer.from(expected), Buffer.from(req.get('X-Prophecius-Signature') || ''));
  if (!ok || Math.abs(Date.now() / 1000 - Number(ts)) > 300) return res.sendStatus(401);
  const event = JSON.parse(req.body);
  // ... save event.data to your CRM
  res.sendStatus(200);
});

<?php // PHP
$body = file_get_contents('php://input');
$ts = $_SERVER['HTTP_X_PROPHECIUS_TIMESTAMP'] ?? '';
$expected = 'sha256=' . hash_hmac('sha256', $ts . '.' . $body, getenv('PROPHECIUS_SECRET'));
if (!hash_equals($expected, $_SERVER['HTTP_X_PROPHECIUS_SIGNATURE'] ?? '') || abs(time() - (int)$ts) > 300) { http_response_code(401); exit; }
$event = json_decode($body, true);
// ... save $event['data']
http_response_code(200);

# Python (Flask)
import hmac, hashlib, time, os
@app.post('/hooks/prophecius')
def hook():
    ts = request.headers.get('X-Prophecius-Timestamp', '')
    expected = 'sha256=' + hmac.new(os.environ['PROPHECIUS_SECRET'].encode(), (ts + '.').encode() + request.get_data(), hashlib.sha256).hexdigest()
    if not hmac.compare_digest(expected, request.headers.get('X-Prophecius-Signature', '')) or abs(time.time() - int(ts or 0)) > 300:
        return '', 401
    event = request.get_json()
    # ... save event['data']
    return '', 200

Answer with any 2xx within six seconds. If your server errors, we try once more two seconds later. Send a test from the dashboard, or POST /api/v1/webhook/test.

5. Connect a CRM without writing code

Zapier (HubSpot, Salesforce, Pipedrive, Zoho, 6,000+ apps)

Create a Zap with trigger “Webhooks by Zapier → Catch Hook” and copy its URL.
Paste that URL as your webhook in Dashboard → Developers / API, and send a test.
Add an action: “HubSpot → Create Contact” (or any CRM), and map name, phone, email and message from the test.

Make.com or Pabbly Connect

Add a “Custom webhook” module and copy its address.
Paste it as your webhook and send a test so Make learns the fields.
Add your CRM module and map the fields.

Google Sheets

In a sheet, Extensions → Apps Script. Add a doPost(e) that appends JSON.parse(e.postData.contents).data to the sheet.
Deploy → New deployment → Web app, access “Anyone”, and copy the URL.
Paste it as your webhook. Every new lead becomes a row.

Your CRM pushing changes back

Use PATCH /api/v1/leads/{id} when a deal moves, so the dashboard shows won or lost.
Use POST /api/v1/leads for leads that start in your CRM, so the bot can follow them up.
Use GET /api/v1/leads?updated_since=... for a scheduled two-way sync.