The brief
The goal: let any site add an AI chat by pasting one tag, the way you add analytics. No framework lock-in, no rebuild of the host site, and no API keys leaking into the browser.
What we built
A framework-agnostic web component built with Stencil. It compiles to a standard custom element, so the same tested artifact drops into WordPress, React, Vue, or plain HTML.
Behind it, a Laravel service owns everything sensitive: API keys, prompts, conversation state, and rate limiting. Answers are generated by AWS Bedrock. The embed stays a thin shell; the product lives server-side.
Key decisions
A web component, not N SDKs
Shipping one standards-based custom element beat maintaining per-framework wrappers. Every site gets the same artifact, tested once.
Nothing secret in the browser
Keys, prompts, and model choice live in the Laravel service. Models can be swapped and prompts tuned without customers ever touching their embed code.
Managed models via Bedrock
Bedrock gave model choice behind one AWS-native API, with no GPU fleet to babysit and clean IAM-based access control.
Outcome
- One tag to embed on any stack, from CMS sites to SPAs.
- Zero credentials in the browser; the server owns the AI.
- Prompts and models can change without touching customer sites.
Common questions
- How do you add an AI chatbot to a website without rebuilding it?
- Ship it as a standards-based web component. The widget compiles to a custom element, so installing it means pasting one script tag, the same way you add analytics. The same tested artifact works on WordPress, React, Vue, or plain HTML.
- Is it safe to put an AI API key in a website widget?
- No. Anything shipped to the browser is public. In this build the embed stays a thin shell; API keys, prompts, conversation state, and rate limiting all live in a Laravel service, and AWS Bedrock generates the answers server-side.
- Can the AI model or prompts change after customers embed the widget?
- Yes. Model choice and prompts live server-side, so they can be swapped or tuned at any time without customers ever touching their embed code.