Testing your integration

Use the staging ID and https://staging.chatbot.tiketo.cloud on your staging site. Tiketo can enable an agreed http://localhost:<port> or http://127.0.0.1:<port> origin for that staging ID on request. Production IDs accept only their production origins.

Check an origin before opening the page

Replace the client ID and origin with the exact values you will use, then run:

curl -sS -o /dev/null -w '%{http_code}\n' \
  -H 'Origin: http://localhost:5173' \
  https://staging.chatbot.tiketo.cloud/config/TC-XXXXXXXX.json

Expect 200 when that exact scheme, host, and port is allowed, or 403 when the valid client ID exists but the origin is not allowed. A different result usually means the ID or endpoint is wrong. Opening the URL directly is not an equivalent test because browser navigation omits the page’s Origin header.

Smoke checklist

1. Confirm the config request returns 200 from the intended page origin.
2. Confirm the launcher appears and opens.
3. Trigger every supplied action and assert the real host effect plus its returned shape.
4. Trigger every host component, exercise keyboard interaction, reply once, and navigate away to prove cleanup.
5. Test CSP with browser console reporting enabled.
6. Test logout with await tiketoChat("reset"); force reset failure once and confirm the host still logs out, hides the launcher, and reports the error. For an immediate account-switch relaunch, set the new context first and use { relaunch: true }.

Test handlers without an agent

Keep business behavior in ordinary functions and register a thin adapter. Call the function directly in unit tests.

export function currentRoute(): { route: string } {
  return { route: window.location.pathname };
}

tiketoChat("action", "whereAmI", currentRoute);

// Unit test
history.replaceState({}, "", "/checkout");
expect(currentRoute()).toEqual({ route: "/checkout" });

For a component, export the renderer, pass it a detached document.createElement("div"), and spy on reply. Assert payload escaping, one intended reply from your UI, and returned cleanup. The embed itself enforces one-shot delivery and contract validation.

The password-protected Tiketo demo is the reference implementation; ask your Tiketo contact for access when you need to compare behavior.