Call Talk Widget

Let visitors talk to your team directly from your WordPress website. They can start a voice call in their browser or send a message when live chat is enabled. Your operators answer in the Call Talk dashboard. During a call, visitors can approve a request to share a browser tab, window or screen, so your team can see what they need help with while you talk. Operators can view the shared content, and visitors can stop sharing at any time. Screen sharing requires a supported plan and browser. Call Talk is an external hosted service. An active Call Talk account is required; available channels and features depend on your plan and widget settings. Service fees and plan limits may apply. Call Talk Widget connects public WordPress pages to the hosted Call Talk communication service. Choose Connect to Call Talk, sign in or create an account in Call Talk, and approve this website. The plugin installs the public widget token and enables the widget automatically. Manual token setup remains available. Your team answers visitors in the separate Call Talk dashboard. Calls, messages, conversation history, and recordings, where available and enabled, are managed by the service rather than stored in the WordPress database by this plugin. Available channels and features depend on your Call Talk account, plan, and widget configuration.

• Guided, administrator-initiated connection under Settings > Call Talk Widget. No manual token copying is needed for this flow.
• Optional public, domain-specific token setup for existing integrations.
• Separate service-connection permission and frontend enable switch, both off by default.
• No Call Talk request on activation or when opening plugin settings. Connection and disconnection requests run only after an administrator submits the relevant form. Visitor widget loading requires service permission and enabled settings.
• Links to your Call Talk dashboard and account registration.
• Advanced settings for the HTTPS service script, legacy company public keys, and supported theme, language, and channel preferences. The Call Talk service remains authoritative for channels and account features; some display preferences apply only in developer setup mode.

This plugin does not embed the operator dashboard or ask for your Call Talk password in WordPress. Account registration and sign-in take place on the Call Talk website. The WordPress administrator identity is not used as a Call Talk login. Dashboard links use your ordinary Call Talk browser session; the plugin does not grant automatic access to your full Call Talk account. For manual setup, use only the public installation token, which is intended to appear in the website source. Never enter a WordPress password, Call Talk password, private API key, or account access token. External service and visitor data This plugin requires the external Call Talk service at https://call-talk.app and an active account with a plan that supports the configured widget. Service fees or plan limits may apply; see the service website. Installing the plugin does not create an account or purchase a plan. After a site administrator explicitly allows the connection and enables the widget, visitor browsers download the hosted widget JavaScript from https://call-talk.app/widget.js. The script provides the cloud service's visitor interface and communicates with its API and real-time services. Ordinary page loads do not trigger a server-side Call Talk API request. The explicit Connect and Disconnect actions use server-side integration requests as described below. When an administrator submits Connect after granting permission, the WordPress server sends its site URL, callback URL, random state, and a PKCE code challenge to the configured Call Talk service. No WordPress password, email address, or user database is included. Call Talk asks the user to sign in or register, verify their account where required, and approve the website. A short-lived single-use code is exchanged server to server for the public widget token and a restricted connection credential. The credential is stored in a non-autoloaded WordPress option and is never included in page HTML or visitor JavaScript. It can manage this connection only; it cannot sign in to a full Call Talk account. Temporary state and its verifier are bound to the initiating WordPress administrator and expire after 10 minutes. Disconnect sends the restricted credential to the Call Talk connection endpoint to revoke the link and turns the widget off locally. It does not delete the Call Talk account or conversation history. If the service is unavailable, local widget loading stops immediately and the restricted credential is retained for a retry. When the widget loads, the service receives the public widget token or legacy company public key, website origin, full page URL (including its query string), page title, and ordinary network request information such as the visitor IP address and browser information. These are used to load and authorize the website widget. Avoid putting sensitive information in public page URLs or titles. When visitors use communication features, the service processes the contact details and messages they submit, conversation identifiers, call signaling, and related session information. Audio, recordings, or shared screen content may be processed when the corresponding service feature is available and the visitor grants the applicable permission or consent. The hosted widget uses browser storage to restore communication sessions. Review the service policies and configure your website's visitor notices and consent requirements for the features you enable. The advanced Widget Script URL setting can point to another trusted HTTPS Call Talk deployment. In that case the configured deployment provides the widget and receives its service requests; review that deployment's policies before allowing it. Uncheck either service connection or widget enablement and save to stop this plugin from loading the widget on subsequent page loads. Purge website caches if needed. Already open conversations may remain active until their page is closed or the conversation ends.

• Service website and account: https://call-talk.app/
• Terms of Service: https://call-talk.app/terms
• Privacy Policy: https://call-talk.app/privacy
• Call recording notice: https://call-talk.app/recording-notice

1. Upload the call-talk-widget folder to /wp-content/plugins/, or install the plugin ZIP through Plugins > Add New > Upload Plugin.
2. Activate Call Talk Widget. Activation does not contact Call Talk or create an account.
3. Open Settings > Call Talk Widget. Review the connection disclosure, select the permission checkbox, and choose Connect to Call Talk.
4. In Call Talk, sign in to an existing account or create and verify an account. Review the website and approve the connection. An active account and plan supporting the widget are required.
5. You return to WordPress with the website connected and the widget enabled automatically. No token copying is needed.
6. Open a public website page to verify the widget. Remove any previous manual Call Talk embed to avoid duplicate loading, and clear page caches after setup changes.

For manual setup, expand Manual Token Setup, open Widget Installation in Call Talk, add the exact public website domain, copy its production widget token, paste it into WordPress, allow the service connection, enable the widget, and save. The domain, including www if used, must match the public website. The guided connection requires HTTPS for both WordPress and Call Talk. Local development may explicitly opt in to HTTP using CALL_TALK_WIDGET_ALLOW_LOCAL_HTTP=true together with WP_ENVIRONMENT_TYPE=local or development; that exception is restricted to local testing and is not enabled by the plugin.

0.4.0

• Added nonce-protected guided connection with short-lived state and PKCE.
• Added automatic public widget configuration after Call Talk account approval.
• Kept restricted connection credentials server-side and outside REST settings.
• Added account/site connection status and remote revocation with safe local disabling.
• Preserved optional manual token configuration and ordinary Call Talk dashboard sign-in.

0.3.0

• Added explicit service permission and disabled-by-default frontend loading.
• Documented hosted service behavior, visitor data, account requirements, and legal links.
• Hardened administrator access, public token handling, HTTPS script validation, and option sanitization.
• Added accessible setup instructions, native WordPress settings, and account/dashboard links.
• Added the GPL license text and local settings-page assets.

0.2.0

• Added production widget token support.
• Added call/chat, theme, and language settings.
• Added inline runtime settings for CMS-safe loading.

0.1.0

• Initial widget loader.