Build on ZChat
ZChat has a REST API for conversations, messages, contacts, labels and inboxes, documented on your own server at /api/docs. Webhooks tell your systems when something happens, and the widget has a JavaScript SDK for your own site.
The developer tools are free on every edition. This page describes the ASP.NET Core edition of ZChat 2.0.5; the separate Web Forms package does not include the 2.0.5 additions.
Each agent creates personal access tokens, read-only or read and write, with an expiry. A token can do only what its agent can do.
Events such as a conversation starting, a new message, a status change, an inbound email or an SLA breach are posted to your URL, signed with HMAC-SHA256.
Open, close and reset the widget from your page, listen for events, and pass a signed-in user with an HMAC so agents see a verified identity.
The reference at /api/docs lists the endpoints an integration needs, and the OpenAPI 3.0 file imports into Postman, Insomnia or a client generator.
When your server signs the visitor's identifier, the conversation is marked as a verified identity for agents.
CONVERSATION_START, CONVERSATION_MESSAGE, CONVERSATION_END, CONVERSATION_STATUS_CHANGED, VISITOR_ONLINE, VISITOR_WAITCHAT, AGENT_ONLINE, AGENT_OFFLINE, OFFLINE_MESSAGE, EMAIL_RECEIVED, SLA_BREACHED and AUTOMATION_RULE.
Your server computes HMAC-SHA256 of the visitor's identifier with a secret set in the dashboard, and the page passes it to ZChat.setUser. Verified visitors are filed under their own contact.
A token has its agent's rights as they are at each request, never more. A read-only token can only read, and no token can create another token.
The /api/docs reference covers conversations and messages, contacts, labels, inboxes, the channel webhook and the token's own identity. It is not a list of every endpoint the dashboard uses.
No. The REST API, access tokens, webhooks, the widget SDK and identity verification are in the free Community edition. Calls that touch a paid feature answer with a clear requires_premium or requires_enterprise code.
Each request carries an X-ZChat-Signature header: sha256 followed by the hex HMAC-SHA256 of the timestamp, a dot and the body, using your webhook secret.
Your server signs the visitor identifier with HMAC-SHA256 and a secret from the dashboard. The page passes the identifier and the hash to ZChat.setUser, and ZChat marks the visitor as verified.
The API, webhooks and widget SDK are free with unlimited agents on every edition.
ZChat gives you the installable server, web dashboard, website widget, and desktop agent tools in one self-hosted product, with live chat free to run. Run it on infrastructure you trust and connect AI only if and how you want it.
Deployment
Install on Windows or Linux, behind IIS or Nginx, in a VM, or in Docker if that fits your stack.
Commercial model
Live chat is free with unlimited agents. Only the optional AI assistant is billed, per agent per month.
AI Flexibility
Use Ollama locally or connect OpenAI and Anthropic with your own provider accounts.