About this plugin
TWT Chat is a small WordPress integration for the TWT Chat external SaaS. The plugin is disabled after activation. An administrator with the manage_options capability clicks the TWT Chat menu and is sent directly to the Accounts address baked into the installed package to sign in.
The external Chat Console recognizes the WordPress source, shows the restricted project-list view, and returns the selected app_id, normalized address, and per-binding sign_key through a one-time callback.
The plugin does not contain the chat interface, iframe runtime, HTTP API, WebSocket implementation, or browser persistence. It loads the visitor-next loader for the installed build environment only when the setting is enabled and the appid passes the strict ASCII validation contract.
Settings
The plugin stores one site-wide appid, normalized site address, per-binding sign_key, and an enabled flag in the twt_chat_options WordPress option. Valid appids contain only ASCII letters, numbers, underscores, and hyphens and are 1 to 128 characters long. There is no editable App ID field and no legacy migration path.
A successful binding writes enabled=true; Disconnect your account first calls the same-environment /console/site/wordpress_unbind endpoint with a signed request, then clears all local binding fields only after code=1, without deleting the TWT project.
The successful project binding authorizes this site to load the external TWT Chat service. It does not replace any visitor consent that the site or a completed TWT Chat privacy assessment may require.
External Services
When a project has been successfully bound and enabled on a front-end page, the plugin loads this fixed HTTPS visitor-next loader:
- https://visitorchat.twt.com/install/core.js?version=v1.2
The loader can create the default launcher and panel and may connect the browser to TWT Chat runtime services. The plugin provides the bound appid; the runtime may also process the current page URL and title, visitor session data, chat messages, and cookies, Local Storage, or other browser storage needed to keep chat state. The processing purpose is to provide the requested chat experience and maintain its session.
com/api/. Verified runtime requests include GET /api/fk/user/get_domain_bmd during widget bootstrap, POST /api/fk/user/login when visitor authentication starts, and /api/fk/chat/*, /api/fk/msg/*, or /api/fk/common/* requests only when the visitor uses the corresponding chat features. com/ws.
No widget iframe, API, or WebSocket request is made while the plugin is unbound or disabled.
The plugin does not store a TWT token. It generates a 32-byte random state for each start request, stores only the SHA-256 state digest in a 1-hour (3600-second) transient, and deletes that transient on callback success or failure. The callback accepts state, a strictly validated public app_id, a normalized HTTP(S) address, and a non-empty opaque sign_key.
The key is not displayed and is used only to sign the later disconnect request.
The confirmed policy links are:
- Terms of Service: https://www.twt.chat/a/agreement
- Privacy Policy and deletion requests: https://www.twt.chat/a/privacy
The production service endpoints, request timing, data-processing terms, consent responsibilities, and loader release controls have been verified for this version. Responsibility for visitor consent remains with the site owner. Administrator enablement authorizes the external service load but is not itself visitor consent.
Sites that require opt-in must delay enablement until their consent mechanism allows the service. TWT Chat’s current service documentation and Privacy Policy govern retention, deletion requests, controller/processor roles, subprocessors, and cross-border processing. 2 loader is immutable for this release, version-pinned in the package, and managed through reviewed compatibility, release, audit, and rollback controls.
Uninstalling this plugin retains the local twt_chat_options binding data and sets its enabled flag to false. Reactivating a complete retained binding on the same site origin enables the integration without another authorization flow. Uninstalling the plugin does not delete TWT Chat server-side history.
Use the TWT Chat Privacy Policy and its deletion-request route for service-side data requests.
Privacy
The plugin registers suggested text with the WordPress Privacy Policy guide. Site owners must review that text, their own consent tooling, and the current TWT Chat Privacy Policy before enabling the service for visitors.
Support
com/.
Release readiness
org author, contributor, Plugin URI, Author URI, support channel, and directory assets have been verified and completed for this release. org directory asset channel.