The chat widget — What happens when a visitor opens the chat

Your page loads a small launcher and an iframe pointing at /w/{token} on RowFold's own origin. Everything that touches data runs inside that iframe, same-origin with us, so the conversation's credential never enters your page's JavaScript, a hostile site hosting the widget cannot read it, and no cross-origin API surface has to exist at all. The first message creates the ticket through the ordinary write path — Auto number stamps a reference, automations fire, a chat ticket is not a second-class ticket. The record is named after the question actually asked, trimmed at a word, because that is what an agent scans in the grid.