One script tag,
a chat widget.

The snippet

Paste it, cross-origin by design.

Find your app id with guuey apps list (guuey apps create prints one for a new app), then paste:

<!-- guuey widget. Add this site to the app's allowed domains or the embed is refused. -->
<script>
  window.guuey = window.guuey || function(){(guuey.q=guuey.q||[]).push(arguments)};
  guuey("init", {
    app: "app_abc123",
  });
</script>
<script src="https://widget.guuey.com/v1.js" async></script>

The first <script>block is a small queue shim, not decoration — it has to load before the second, async tag arrives, and it's what makes the load order stop mattering: any guuey("init", …) call made before v1.js finishes downloading queues up and replays automatically once it does. Paste the whole block verbatim, in this order.

Anonymous limits

What an anonymous visitor gets.

• .Chat and generative UI — identical to an identified visitor.
• .Threads that survive a page reload, in that browser.
• .Not durable memory, a cross-app profile, or a durable home directory — those need a real, durable identity (see Identity above).
• .Continuity is best-effort. The widget keeps its guest identity in the iframe's own storage — a cookie can't survive a third-party frame at all — so a browser that partitions or clears that storage (Safari today, and increasingly others) starts every page load as a new visitor. The chat still works; it just stops remembering the last one.

Advanced

Bring your own UI instead.

Every guuey-hosted agent also answers a public endpoint over Server-Sent Events, independent of the widget above. Call it with fetch or curl, or drop in the @guuey/agent-client React hook for a working chat surface in about fifteen lines. Skip this section if the script tag above is enough.

The response

Four event types, one stream.

event: session
data: {"sessionId":"...","userId":"...","authMode":"anonymous","threadId":"..."}

event: message
data: {"type":"text.delta","delta":"Tok"}
data: {"type":"text.delta","delta":"yo is 22°C and clear."}
  … one or more per turn — plus turn/message/tool lifecycle events

event: done
data: {"stopReason":"end_turn","threadId":"...","userSeq":1,"agentSeq":2}

event: error
data: {"code":"...","message":"..."}   // only on failures

session opens the stream and carries your resolved identity plus the threadId to persist. message fires one or more times per turn, normalized to AgJSON — text streams as text.delta. done closes the turn with a stopReason (end_turn / max_turns / error / aborted). error only appears on failure — a clean turn never sends one. (The message payloads above are trimmed for illustration — real events carry additional fields like seq, id, and turnId.) Parsing this by hand works, but the SDK below already reduces the stream into plain text for you.

Identity

Three ways to be someone.

• .Guest cookie (browsers, automatic) — the first call mints an HttpOnly guuey_guest cookie; every browser request after that replays it, no code required.
• .x-guuey-guest header (native clients, and the widget above) — apps without a cookie jar generate and persist their own 64-character hex secret and send it on every request instead.
• .Authorization: Bearer (signed-in users) — Guuey sign-in access tokens are always accepted; if the app's Users → Authentication mode is set to Bring Your Own Auth, tokens from your own OIDC provider are verified against its published keys too. An invalid Bearer never falls back to a guest — it's a 401.

In the public beta, Bring Your Own Auth end users get durable per-user agent memory too — "my agent remembers me" won't be just for Guuey sign-in. One caveat to plan for now: a user's identity is derived from your issuer URL and their subject claim together, so changing your app's identity provider resets your users' agent memory — every existing user gets a new derived identity on the new issuer, with no stored memory attached to it. Plan issuer changes accordingly.

The SDK

@guuey/agent-client

npm install @guuey/agent-client

"use client";

import { useMemo } from "react";
import { createWebAdapters } from "@guuey/agent-client";
import { useAgentInvoke } from "@guuey/agent-client/react";

export function AgentChat({ appId }: { appId: string }) {
  const adapters = useMemo(() => createWebAdapters(), []);
  const { messages, send, isStreaming, error } = useAgentInvoke({
    endpointUrl: `https://${appId}.<agents-domain>`,
    appId,
    adapters,
  });

  return (
    <div>
      {messages.map((m, i) => (
        <p key={i}><strong>{m.role}:</strong> {m.text}</p>
      ))}
      {error && <p>{error}</p>}
      <button disabled={isStreaming} onClick={() => void send("Hello!")}>
        Send
      </button>
    </div>
  );
}

createWebAdapters() with no arguments talks as an anonymous guest — the same guest-cookie identity as a plain fetch call, no sign-in needed. useAgentInvoke owns the SSE parsing, the threadId round-trip, and message state, so the snippet above is a complete (if minimal) chat surface.

createWebAdapters also takes apiBaseUrl(your app's public API base, ending in /v1), getAccessToken (an async function returning the caller's signed-in bearer token), and getGuestSecret(a sync function returning an anonymous guest secret your own storage manages — the widget's own anonymous mode is exactly this, keyed per app rather than per cookie). Set apiBaseUrl plus either identity function and the hook also fetches GET {apiBaseUrl}/threads/{threadId}/messages on mount, repainting a caller's transcript before they type anything — so their chat survives a page reload. Skip them and anonymous guest-cookie chats still work identically on the pod (the persisted threadIdcarries the conversation forward); only the browser's visible history needs a reload to forget, since the read plane can't identify a cookie-only guest.