Four steps, no build tooling, no SDK. If you can paste a script tag, you can ship Viavitna.
Viavitnapub_… publishable key (for the widget) and a sec_… secret key (for server-to-server use — store it; it's shown once).</body> on your site:<script src="https://viavitna.com/widget.js"
data-viau-tenant="your-company"
data-viau-key="pub_..." defer></script>
Then lock the key to your site so it works nowhere else — set your origin allowlist in the console (or ask us to).
| Attribute | Required | Meaning |
|---|---|---|
data-viau-tenant | yes | Your tenant id. |
data-viau-key | yes | Your publishable (pub_…) key. Safe to embed; protect it with the origin allowlist. |
data-viau-title | no | Panel title (default "Ask us"). |
data-viau-lang | no | en (default) or es — interface and answer language. |
data-viau-host | no | Override the API host (defaults to where the script was loaded from). |
The widget uses this endpoint; you can call it directly for custom UIs or server-side integration.
POST https://viavitna.com/t/<tenant>/answer
Headers: content-type: application/json
x-viau-public-key: pub_... (browser) — or —
x-viau-key: sec_... (server-to-server)
Body: {"question": "How do returns work?", "language": "en"}
Response: {
"ok": true,
"status": "direct", // or conditional / insufficient
"mode": "generated", // or extractive_fallback
"answer": "Items can be returned within 30 days…",
"citations": [{"title": "Returns policy", "url": "https://your-site/returns"}],
"limitations": [],
"receipt": {
"snapshotId": "…", // binds pack, evidence, validation and model policy
"packSha256": "…",
"evidenceIds": [1]
}
}
| Result | Meaning |
|---|---|
status: insufficient | Your content doesn't cover the question; the answer says so honestly. |
mode: generated | A verified, cited answer written from your passages. |
mode: extractive_fallback | A verbatim relevant passage — served when generation is unavailable or unverifiable. Still cited, still true. |
receipt.snapshotId | A tamper-evident identifier for this answer decision. It binds the serving pack, evidence and validation state; it is not a claim that the customer's source itself is correct. |
401 / 403 / 429 | Bad key / origin not allowed / rate limited. |
Server-side MCP clients can connect to POST /mcp/<tenant> using Authorization: Bearer sec_... and the stateless MCP 2026-07-28 headers and metadata. The server exposes one tool, viavitna_answer, which returns the same grounded answer, citations, limitations and receipt. Publishable keys are rejected, and there are no upload, draft, publish, tenant-discovery, shell or filesystem tools.
Viavitna never stores the words in widget, API or MCP questions. Its short-lived operational ledger contains only a keyed fingerprint and minimal outcome/evidence fields; raw-question logging cannot be enabled.