About this plugin
Epkora Live Chat connects a WordPress website to an Epkora workspace and loads
the Epkora Live Chat service on the public site. Epkora is an external
Software-as-a-Service customer-support platform; this plugin is not a local
WordPress help desk. An Epkora account and workspace are required.
After activation, an administrator connects the site to an Epkora workspace and
approves it; Live Chat then loads automatically. No API key, copied JavaScript,
or theme edit is required.
What the plugin does
- Adds the Epkora Live Chat service to public-facing WordPress pages.
- Shows the connection and Live Chat state on a dedicated Epkora settings page.
- Checks the installation with Epkora after connection so remote revocation and
Live Chat changes are reflected in WordPress.
- Lets an administrator disconnect or reconnect the website.
- Never loads the chat widget in wp-admin.
What the plugin does not do
- It does not send WordPress posts, pages, comments, users, email addresses,
WordPress version, or PHP version to Epkora.
- It does not grant Epkora access to WordPress administration.
- It does not add analytics, advertising, affiliate links, review prompts,
dashboard widgets, or a public-site credit of its own.
- It does not make an administrative status request from PHP on every public
page load. When connected, each visitor’s browser does contact Epkora to load
and use the external Live Chat service, as described below.
Connection security
The explicit administrator connection uses a cryptographically random state
value and PKCE S256. WordPress sends the browser to Epkora for sign-in,
workspace selection, and approval. Epkora returns a short-lived, single-use
authorization code. The WordPress server exchanges that code and the PKCE
verifier directly with Epkora.
The resulting installation credential is stored in the WordPress Options API,
is not autoloaded, and is sent only to the fixed Epkora integration API over
HTTPS. Epkora stores a hash of that credential. The credential is limited to
installation status and disconnection operations; it does not authorize access
to Epkora conversations, contacts, tickets, team settings, or billing.
External Services
This plugin depends on the Epkora SaaS platform. The following requests occur
only after a WordPress administrator explicitly starts or has completed a
connection.
www.epkora.com
Authorization. When an administrator clicks Connect to Epkora, their
com/integrations/wordpress/authorize. The URL
contains a random state value, the WordPress callback URL, the site’s public
URL and name, the PKCE S256 challenge, and the plugin version. Epkora receives
ordinary connection metadata such as the administrator’s IP address and
browser user agent. Sign-in, workspace selection, and approval happen on
Epkora. WordPress receives the authorization result and a short-lived code; the
administrator’s Epkora password is never sent to WordPress.
Live Chat service. Once connected and enabled, public pages load
js asynchronously. This remote JavaScript
is the client for the Epkora SaaS Live Chat service: it creates an Epkora-hosted
chat frame and communicates with Epkora for widget configuration, availability,
messages, agent replies, and related chat features. It is not a WordPress
update mechanism. Ordinary plugin administration CSS and images are packaged
locally with the plugin.
Loading the service sends the Epkora embed key and the embedding hostname to
Epkora, together with normal web-request metadata such as the visitor’s IP
address, browser user agent, origin/referrer information made available by the
browser, and requested page. Opening Live Chat retrieves the configured widget
and team availability. If a visitor starts a conversation, requests contain
the message and client message identifier, the current-page value supplied by
the service client, and any configured profile or topic fields the visitor
chooses to provide, such as name, email address, phone number, or topic. Epkora
may derive browser, device, and operating-system details from request headers
and uses the IP address for service security and rate limiting.
Epkora returns widget configuration, availability, a conversation identifier,
conversation history, agent messages, and other chat responses needed to
provide the service. A secure Epkora visitor-session cookie is set after a
visitor sends their first message so the conversation can continue. Any
Epkora branding displayed inside the chat frame is output of the external
service, not a link injected into WordPress content by this plugin.
integrations.epkora.com
Authorization-code exchange. After approval, the WordPress server sends a
JSON POST request to
com/api/integrations/wordpress/exchange. It contains
the one-time authorization code, WordPress site URL, fixed callback URL, PKCE
verifier, site name, and plugin version. The request user agent also identifies
the plugin version and site URL. The response contains the installation
credential, embed key, workspace name, approved site URL/domain, Live Chat
state, connection time, and validated Epkora script URL.
Installation status. A status request runs on the Epkora settings page
after a short cooldown and approximately daily through WordPress cron. It sends
the installation credential in an Authorization header and the plugin version
in a JSON body; its user agent identifies the plugin version and site URL.
Epkora returns whether the installation is connected or revoked, plus the
embed key, workspace name, approved domain, and Live Chat state. Public page
requests do not trigger this PHP status call.
Disconnect and uninstall. Clicking Disconnect sends an empty JSON array
with the installation credential in an Authorization header. Uninstall sends
an empty JSON object to the same endpoint on a best-effort basis with a generic
Epkora user agent. In both cases Epkora is asked to revoke the installation.
Local Epkora options and scheduled events are removed even if Epkora is
unavailable.
The Epkora integration API also receives ordinary server connection metadata,
including the WordPress server’s public IP address. These requests are
operational parts of the user-authorized service connection; the plugin sends
no unrelated analytics or telemetry.
Terms and privacy
Epkora processes connection details, site metadata, and live-chat information
as described in the following documents:
- Privacy Policy: https://www.epkora.com/privacy
- Terms of Service: https://www.epkora.com/terms
By connecting a site, the administrator confirms that they are authorized to
connect it and that their site gives visitors any privacy notice or choice
required for the Epkora live-chat widget.