# Iblai Agent Embed

> Configure an ibl.ai agent's embed/widget settings via the platform API — anonymous access, custom CSS/JS, mode, voice/attachment toggles, starter prompts, SSO, share links, and redirect tokens. Use when embedding an agent on an external website.

- **Type:** Skill
- **Install:** `agentstack add skill-iblai-api-iblai-agent-embed`
- **Verified:** Yes — security-reviewed for prompt injection and unsafe behavior
- **Seller:** [iblai](https://agentstack.voostack.com/s/iblai)
- **Installs:** 0
- **Category:** [Developer Tools](https://agentstack.voostack.com/c/developer-tools)
- **Latest version:** 0.1.0
- **License:** MIT
- **Upstream author:** [iblai](https://github.com/iblai)
- **Source:** https://github.com/iblai/api/tree/main/skills/iblai-agent-embed
- **Website:** https://ibl.ai/join

## Install

```sh
agentstack add skill-iblai-api-iblai-agent-embed
```

Requires the [AgentStack CLI](https://agentstack.voostack.com/docs/cli). Works with Claude Code, Cursor, and any MCP-compatible agent.

## About

# iblai-agent-embed

Configure an agent's embed/widget settings through the API: anonymous access,
custom CSS/JS, widget mode, voice/attachment toggles, starter prompts, SSO, plus
the share link and redirect tokens that let an agent live on an external site.
Use when embedding an agent on an external website.

## Auth & conventions

- **Base URL:** `https://api.iblai.app`
- **Header:** `Authorization: Api-Token $IBLAI_API_KEY` on every request.
- **Path vars:** `{org}` = `$IBLAI_ORG`, `{username}` = `$IBLAI_USERNAME`,
  `{mentor}` = the agent's unique id (e.g. `d17dc729-60fd-4363-81a0-f67d9318b03e`).
- **Embed writes** go through one endpoint —
  **PUT** `…/mentors/{mentor}/settings/` with `multipart/form-data` — sending
  **only the changed field(s)**.
- Not connected yet? Run **`/iblai-login`** first to populate `IBLAI_ORG`,
  `IBLAI_USERNAME`, and `IBLAI_API_KEY`.

## Reads

- **GET** `…/mentors/{mentor}/public-settings/` — current embed settings.
- **GET** `…/mentors/{mentor}/settings/` — current custom CSS/JS.
- **GET** `…/mentors/{mentor}/sharable-link` — existing share-link token (404 = none).
- **GET** `https://learn.iblai.app/ibl-auth/get-provider-slug/?platform_key={org}&username={username}` — SSO providers (LMS host).

### Backend token provisioning

- **GET** `https://api.iblai.app/dm/api/core/users/platforms/` — fetch the user's organization/platform record.

## Writes

- **PUT** `…/mentors/{mentor}/settings/` — save embed settings (`multipart/form-data`, send only changed keys):
  ```json
  {
    "allow_anonymous": "boolean",
    "custom_css": "string",
    "website_url": "string",
    "mode": "default|advanced",
    "is_context_aware": "boolean",
    "mentor_visibility": "string|null",
    "embed_show_attachment": "boolean",
    "embed_show_voice_call": "boolean",
    "embed_show_voice_record": "boolean",
    "show_catalogue": "boolean",
    "starter_prompts": "guided_prompt|suggested_prompt",
    "sso": "boolean",
    "sso_provider": "string",
    "auto_open": "boolean",
    "slug": "string",
    "safety_disclaimer": "boolean"
  }
  ```
  To set advanced styling, send just `custom_css`; for advanced scripting, send `custom_javascript`.
- **POST** `…/mentors/{mentor}/sharable-link` — create / regenerate the share link (empty body).
- **PUT** `…/mentors/{mentor}/sharable-link` — enable / disable the share link:
  ```json
  {
    "enabled": "boolean"
  }
  ```
- **POST** `https://api.iblai.app/dm/api/core/orgs/{org}/redirect-tokens/` — mint a redirect token for the embed site:
  ```json
  {
    "url": "string (required)",
    "mentor_unique_id": "string"
  }
  ```

### Backend token provisioning (server-to-server embed auth)

Skip the SSO login popup by minting the user's tokens from your own backend, then
handing the embed the same `ibl-data` blob the Auth SPA would have produced. All
calls are **server-to-server** with the org's Platform API Token — never expose
this in browser JS.

- **POST** `https://api.iblai.app/dm/api/core/consolidated-token/provision/` — resolve-or-create the user and mint `dm_token` + `axd_token`.
- Assemble those into the `ibl-data` payload and pass it to the iframe.

Gated per-org by the ibl.ai-managed flag `ENABLE_PLATFORM_CONSOLIDATED_PROXY_PROVISIONING`
(must be `true`, else the provision endpoint returns **404** — contact ibl.ai to enable).

## Example

Allow anonymous access and turn on the widget's attachment button (only the two
changed fields are sent):

```bash
curl -X PUT \
  "https://api.iblai.app/dm/api/ai-mentor/orgs/$IBLAI_ORG/users/$IBLAI_USERNAME/mentors/$MENTOR/settings/" \
  -H "Authorization: Api-Token $IBLAI_API_KEY" \
  -F "allow_anonymous=true" \
  -F "embed_show_attachment=true"
```

## Notes

- A field left out of the PUT is left unchanged — never resend the whole object.
- The SSO providers read uses the LMS host `learn.iblai.app`, not `api.iblai.app`.
- A `404` on **GET** `…/sharable-link` just means no share link exists yet —
  **POST** to create one.

## Source & license

This open-source skill is cataloged on AgentStack and links to its original source — we do not rehost the code.

- **Author:** [iblai](https://github.com/iblai)
- **Source:** [iblai/api](https://github.com/iblai/api)
- **License:** MIT
- **Homepage:** https://ibl.ai/join

Install and usage instructions live in the source repository linked above.

## Pricing

- **Free** — Free

## Security capabilities

Automated source analysis of v0.1.0 — what this tool can access:

- **Network access:** yes
- **Filesystem access:** no
- **Shell / process execution:** no
- **Environment & secrets:** no
- **Dynamic code execution:** no

*"Yes" means the capability is present in the source — more access means more to trust, not that it is unsafe.*


## Versions

- **0.1.0** — security scan: passed — Imported from the upstream source.

## Links

- Listing page: https://agentstack.voostack.com/l/skill-iblai-api-iblai-agent-embed
- Seller: https://agentstack.voostack.com/s/iblai
- Browse the marketplace: https://agentstack.voostack.com/browse

---
Listed on AgentStack — the marketplace for AI agent skills and MCP servers. Every listing is security-reviewed. Creators keep 70%.