> ## Documentation Index
> Fetch the complete documentation index at: https://docs.sendora.ai/llms.txt
> Use this file to discover all available pages before exploring further.

# Voice widgets

> Configure and embed a Sendora voice widget on an external website.

Widget runtime endpoints are intentionally unauthenticated so a browser visitor can load a configured widget. Management endpoints remain API-key protected.

## Security model

* Treat the widget public ID as public, not as an API secret.
* Keep API keys out of browser JavaScript.
* Configure allowed origins before embedding.
* Never expose private agent configuration or webhook secrets in widget responses.

## Runtime endpoints

```text theme={"dark"}
GET  /api/v1/public/widget/{widget_public_id}/config
POST /api/v1/public/widget/{widget_public_id}/calls
```

The runtime call endpoint starts a two-way WebRTC browser call with the widget's voice agent. For step-by-step setup, the generated embed code, and a custom browser client example, see [WebRTC browser calls](/guides/webrtc-browser-calls).

## Embed checklist

1. Select a published voice agent.
2. Create a widget and configure its origin allowlist.
3. Fetch the generated embed configuration.
4. Test from an allowed origin.
5. Confirm calls, rate limits, and failures before production rollout.


This documentation is built and hosted on [Mintlify](https://mintlify.com), a developer documentation platform.