Concepts

Most integration bugs come from mixing up token names or casting companyCode to an integer. Read this once before coding.

Token naming

Name	What it is	Where it goes
`BOT_TENANT_TOKEN`	Long-lived secret from ChatAdmin (widget token)	Server only — used when calling mint
API `signature`	Short-lived session id (~5 minutes)	Returned by `POST /api/chat/token`
Init `tenantToken`	Widget init key	Value = mint `signature`

BOT_TENANT_TOKEN  ──mint──►  { signature }  ──init──►  Mimmo({ tenantToken: signature, systemName })
     (secret)                    (API JSON)                    (browser)

Identity keys

Field	Rule
`userCode`	Always use this — never `userId`. Number or string at mint; stored as string. Omit entirely for anonymous visitors (no `0` / null placeholders).
`companyCode`	Always a string. Never `(int)` cast — codes like `NETCO` break.
`systemName`	Must match ChatAdmin System.systemName exactly for this tenant.

UCT unique key: (systemName, companyCode, userCode).

Session lifetime

Mint once per page load (or after login). Do not cache signatures for hours.
The widget can extend via /api/chat/token/extend while the tab is open.
Redis is mandatory on Mimmo for mint/resolve — see health checks.

Continue to Authentication.