Public beta preview — you're seeing the sneak peek

Laravel — install the widget

read as .md

In a Laravel app the tag goes into the Blade layout your views share. The tag is the same on every platform — Install the widget has the general picture; this page has the exact place on Laravel.

The tag

<!-- guuey widget. Add this site to the app's allowed domains or the embed is refused. -->
<script src="https://widget.guuey.com/v1.js" data-app="app_abc123" async></script>

Where it goes

Open the layout your views share: with template inheritance it is resources/views/layouts/app.blade.php, the file child views @extends('layouts.app') and that carries @yield('content') inside <body>; with a layout component it is resources/views/components/layout.blade.php, rendering {{ $slot }}.
Paste the tag just before </body> in that layout and save — Laravel's docs put it plainly: "most web applications maintain the same general layout across various pages", and this is that layout.
Deploy as usual.

Blade leaves an ordinary <script> tag as written; no directive is needed.

Verified against the vendor's documentation on 2026-09-09: Blade Templates — Building Layouts (Laravel docs). Vendor interfaces change — if a step no longer matches what you see, the vendor's page above is the source of truth.

Before it shows

Allow your site’s origin (console → Embed → Allowed origins, or guuey apps update <appId> --domains <origin>; about 15 seconds to apply), add the CSP allowances if your site sets a policy, then verify with guuey apps check <appId> --origin <origin> — the steps are on Install the widget.

Give this to your coding agent

Install the Guuey chat widget on this Laravel (Blade) site. Before changing anything,
read https://docs.guuey.com/embed/laravel.md and https://docs.guuey.com/install-widget.md
(the raw markdown of the two pages) and follow them exactly; do not invent options
or steps they do not contain.

1. Put this tag in the shared Blade layout — resources/views/layouts/app.blade.php (the one views @extends, with @yield('content') in <body>) or resources/views/components/layout.blade.php ({{ $slot }}) — just before </body>, with my app id <appId> in place of app_abc123:
   <script src="https://widget.guuey.com/v1.js" data-app="app_abc123" async></script>
   Add nothing else to the tag — except your page's CSP nonce, if the site uses
   nonces (step 3).
2. Tell me the exact origin(s) my pages are served from (scheme + host) so I can
   add them to the app's allowed domains in the console (Embed → Allowed origins)
   or with: guuey apps update <appId> --domains <origin>. Remind me that a bare
   hostname covers the apex and every subdomain, while a scheme-prefixed origin is
   an exact match, and that changes take about 15 seconds to apply.
3. If this site sets a Content-Security-Policy, add exactly these allowances and
   nothing more. If the policy uses nonces (script-src 'nonce-...'): render the
   site's per-request nonce on the widget tag the way its other script tags carry
   it — that is what lets the loader run, and the loader puts the same nonce on the
   one <style> it injects; then allow https://widget.guuey.com in frame-src and
   connect-src. If the policy uses host allowlists: add https://widget.guuey.com to
   script-src, frame-src and connect-src, and 'unsafe-inline' to style-src.
4. When I've saved the origin, verify with:
   guuey apps check <appId> --origin <origin>
Stop and ask me before any step those two pages do not describe.