Authentication

Meebly AI uses three authentication methods, each serving a different purpose:

• API Keys for direct server-to-server communication
• Backend Tokens for user-scoped tool execution
• Embed Tokens for secure iframe widget embedding

API Keys

API keys are generated when you create an environment in the Meebly dashboard. Each environment has its own unique API key for isolation between your development and production environments.

Using API Keys

Include your API key in the X-API-Key header:

curl -X POST https://api.meebly.ai/v1/chat \
  -H "Content-Type: application/json" \
  -H "X-API-Key: YOUR_API_KEY" \
  -d '{
    "agentId": "agent_abc123",
    "environmentId": "env_xyz789",
    "messages": [{"content": "Hello"}]
  }'

Backend Tokens

When your agent needs to call your backend APIs on behalf of a user, pass the user's JWT token via the X-Backend-Token header. This token is automatically included in all agent-initiated API calls to your endpoints.

curl -X POST https://api.meebly.ai/v1/chat \
  -H "Content-Type: application/json" \
  -H "X-API-Key: YOUR_API_KEY" \
  -H "X-Backend-Token: eyJhbGciOiJIUzI1NiIsInR5cCI6IkpXVCJ9..." \
  -d '{
    "agentId": "agent_abc123",
    "environmentId": "env_xyz789",
    "messages": [{"content": "Update my profile"}]
  }'

The backend token allows agents to make authenticated requests to your APIs, enabling user-specific actions like updating profiles, accessing private data, or executing privileged operations.

Embed Tokens

Embed tokens enable secure agent embedding in iframes without exposing your API key. Create them in the Meebly dashboard with optional domain restrictions and expiration dates.

Creating an Embed Token

Generate embed tokens in the Meebly dashboard. Each token includes:

• Token: JWT to use in X-Embed-Token header
• Encryption Key: For encrypting user backend tokens (keep secure!)
• Domain Restrictions: Optional whitelist (supports wildcards like *.yourdomain.com)
• Expiration: Token validity period

Using an Embed Token

curl -X POST https://api.meebly.ai/v1/chat/embed \
  -H "Content-Type: application/json" \
  -H "X-Embed-Token: YOUR_EMBED_TOKEN" \
  -d '{
    "messages": [{"content": "Hello"}],
    "parentDomain": "yourdomain.com"
  }'

Encrypting Backend Tokens for Embeds

When embedding in iframes, encrypt user backend tokens before sending to prevent exposure:

// In your host application (using CryptoJS)
import CryptoJS from 'crypto-js';

const encryptionKey = 'YOUR_ENCRYPTION_KEY_FROM_DASHBOARD';
const userBackendToken = 'user-jwt-token';

// Encrypt the backend token
const encryptedToken = CryptoJS.AES.encrypt(
  userBackendToken,
  encryptionKey
).toString();

// Send encrypted token in chat request
fetch('https://api.meebly.ai/v1/chat/embed', {
  method: 'POST',
  headers: {
    'Content-Type': 'application/json',
    'X-Embed-Token': embedToken
  },
  body: JSON.stringify({
    messages: [{content: 'Hello'}],
    encryptedBackendToken: encryptedToken,
    parentDomain: window.location.hostname
  })
});

When to Use Each Method