Description
TWT Chat is a small WordPress integration for the TWT Chat external SaaS. The plugin is disabled after activation. An administrator with the manage_options capability clicks the TWT Chat menu and is sent directly to the Accounts address baked into the installed package to sign in. The external Chat Console recognizes the WordPress source, shows the restricted project-list view, and returns the selected app_id, normalized address, and per-binding sign_key through a one-time callback.
The plugin does not contain the chat interface, iframe runtime, HTTP API, WebSocket implementation, or browser persistence. It loads the visitor-next loader for the installed build environment only when the setting is enabled and the appid passes the strict ASCII validation contract.
Settings
The plugin stores one site-wide appid, normalized site address, per-binding sign_key, and an enabled flag in the twt_chat_options WordPress option. Valid appids contain only ASCII letters, numbers, underscores, and hyphens and are 1 to 128 characters long. There is no editable App ID field and no legacy migration path. A successful binding writes enabled=true; Disconnect your account first calls the same-environment /console/site/wordpress_unbind endpoint with a signed request, then clears all local binding fields only after code=1, without deleting the TWT project.
The successful project binding authorizes this site to load the external TWT Chat service. It does not replace any visitor consent that the site or a completed TWT Chat privacy assessment may require.
External Services
When a project has been successfully bound and enabled on a front-end page, the plugin loads this fixed HTTPS visitor-next loader:
https://visitorchat.twt.com/install/core.js?version=v1.2
The loader can create the default launcher and panel and may connect the browser to TWT Chat runtime services. The plugin provides the bound appid; the runtime may also process the current page URL and title, visitor session data, chat messages, and cookies, Local Storage, or other browser storage needed to keep chat state. The processing purpose is to provide the requested chat experience and maintain its session.
For the production package, the widget frame is served from https://visitorchat.twt.com/widget-frame/ and its HTTPS API base is https://visitorchat.twt.com/api/. Verified runtime requests include GET /api/fk/user/get_domain_bmd during widget bootstrap, POST /api/fk/user/login when visitor authentication starts, and /api/fk/chat/*, /api/fk/msg/*, or /api/fk/common/* requests only when the visitor uses the corresponding chat features. After visitor authentication and session initialization, the runtime opens wss://apichat.twt.com/ws. No widget iframe, API, or WebSocket request is made while the plugin is unbound or disabled.
The plugin does not store a TWT token. It generates a 32-byte random state for each start request, stores only the SHA-256 state digest in a 1-hour (3600-second) transient, and deletes that transient on callback success or failure. The callback accepts state, a strictly validated public app_id, a normalized HTTP(S) address, and a non-empty opaque sign_key. The key is not displayed and is used only to sign the later disconnect request.
The confirmed policy links are:
- Terms of Service: https://www.twt.chat/a/agreement
- Privacy Policy and deletion requests: https://www.twt.chat/a/privacy
The production service endpoints, request timing, data-processing terms, consent responsibilities, and loader release controls have been verified for this version. Responsibility for visitor consent remains with the site owner. Administrator enablement authorizes the external service load but is not itself visitor consent. Sites that require opt-in must delay enablement until their consent mechanism allows the service. TWT Chat’s current service documentation and Privacy Policy govern retention, deletion requests, controller/processor roles, subprocessors, and cross-border processing. The v1.2 loader is immutable for this release, version-pinned in the package, and managed through reviewed compatibility, release, audit, and rollback controls.
Uninstalling this plugin retains the local twt_chat_options binding data and sets its enabled flag to false. Reactivating a complete retained binding on the same site origin enables the integration without another authorization flow. Uninstalling the plugin does not delete TWT Chat server-side history. Use the TWT Chat Privacy Policy and its deletion-request route for service-side data requests.
Privacy
The plugin registers suggested text with the WordPress Privacy Policy guide. Site owners must review that text, their own consent tooling, and the current TWT Chat Privacy Policy before enabling the service for visitors.
Support
Support and documentation are available at https://www.twt.com/.
Release readiness
The WordPress.org author, contributor, Plugin URI, Author URI, support channel, and directory assets have been verified and completed for this release. The directory icon, banner, and screenshots are licensed for use with TWT Chat and are supplied through the WordPress.org directory asset channel.
Installation
- Install
twt-chat.zipfrom the WordPress Plugins screen, or place itstwt-chatdirectory underwp-content/plugins/. - Activate TWT Chat for the individual site. Network activation is not supported in this release.
- In the left admin menu open TWT Chat (or Settings). The unbound entry creates a one-time state valid for 1 hour (3600 seconds) and redirects directly to the package’s Accounts address with
appName=chat,channel=wordpress, and the callback origindomainand sitetitlein the Accounts login query. The nested Console redirect contains onlysource=wordpress; the separatewordpress_return_urlparameter carries the callback URL with the state. - Sign in or register. The Accounts service then opens the same-environment Chat Console.
- In the Console,
source=wordpressselects the WordPress source mode. Click Bind/Authorize on an eligible project. The Console validates the callback URL and appends the selectedapp_id, normalizedaddress, and bindingsign_key; the callback’s existing state is preserved. - The plugin validates the current administrator, consumes the state, stores
appid,address,sign_key, andenabled=true, and returns to the connected Settings page. Open a front-end page to verify the floating launcher.
The plugin makes no front-end TWT Chat loader request while unbound or disabled, during activation, during deactivation, or during uninstall. A formal uninstall disables the local binding without deleting it; reactivation on the same site origin restores a complete valid binding automatically. The administrator click starts the external Accounts login redirect only when no complete binding is retained for the current site; the Console performs project authorization and the plugin accepts only the final validated binding callback result.
The environment is fixed at build time and is not configurable. The published package is the production environment: Accounts https://accounts.twt.com/, website https://www.twt.com/, Chat Console https://chat-console.twt.com/, and customer-service client https://chat.twt.com/. Runtime wp-config.php values and URL filters do not override the package environment.
In the WordPress admin menu, Resources opens the matching environment website and Go to TWT Chat opens the matching customer-service client. The Console address remains reserved for authorization and project management. The connected Settings page provides external-browser shortcuts to the client conversation list (/workspace/chat), team members (/workspace/settings/team/service), and widget customization (/workspace/settings/install/custom). The Settings page language selector supports Simplified Chinese, English, and Traditional Chinese for the current administrator. The selected language applies immediately without changing the WordPress site-wide language.
The Accounts login query includes channel=wordpress, domain (the WordPress callback’s protocol, host and port without a path/query/fragment; normally the same as the site origin), title (the WordPress site title, limited to 200 characters), and a separate wordpress_return_url callback parameter. Accounts validates and forwards these fields for the login flow. The backend sets the login token on the shared parent-domain cookie; Accounts does not append a token to the Console URL. The nested Console URL retains only the trusted source=wordpress. After the project bind response supplies the validated callback URL, Console appends the one-time callback result and redirects back to WordPress.
Accounts, Chat Console, and the visitor loader use HTTPS in every package environment. The WordPress site itself may use HTTP or HTTPS; that protocol is retained only in the callback site origin. The visitor loader URL is selected at build time and cannot be changed at runtime.
FAQ
-
Why is the launcher not visible?
-
A fresh installation is off by default. Open TWT Chat > Settings, sign in through Accounts, choose an eligible project in the Console, and complete the callback. After a complete uninstall/reinstall cycle, the retained binding is enabled automatically. The loader starts only after a valid appid is saved with
enabled=true. -
Does deactivation delete chat history?
-
No. Deactivation stops new loader requests and retains local plugin settings. Uninstall also retains the local binding, disables it during removal, and re-enables it after a complete reinstall on the same site origin. It does not delete data held by TWT Chat. Follow the deletion-request guidance in the TWT Chat Privacy Policy.
-
Can I configure an API or WebSocket URL?
-
The plugin does not expose arbitrary URLs in the WordPress UI. The Accounts address is fixed at build time, and each address selects its matching Console automatically. The Console receives only the plugin-generated
wordpress_return_url; its callback URL already carries the one-time state, and Console must append only the validatedapp_id,address, andsign_keywhen returning to WordPress. -
Can I activate this on a Multisite network?
-
No. Network activation is intentionally blocked; configure the plugin separately for each site.
Reviews
Contributors & Developers
“TWT Chat” is open source software. The following people have contributed to this plugin.
Contributors
Translate “TWT Chat” into your language.
Interested in development?
Browse the code, check out the SVN repository, or subscribe to the development log by RSS.
Changelog
1.0.1
- Removed internal environment host names from the distributed package and the plugin description.
1.0.0
- Initial disabled-by-default TWT Chat integration with direct Accounts-to-Console login redirect and the WordPress Privacy API.
- Uninstall now disables and retains local binding data so a reinstall can restore a complete binding automatically.