How to Connect a Website Chatbot to Your Own API for Live Answers

A chatbot trained on your documents can explain your fees, but it cannot tell a parent whether a batch still has seats, or a patient which slots are free tomorrow. That data lives in your own software. If your business runs on a custom system instead of Shopify or WooCommerce, the way to answer those questions is a small API endpoint. This guide is for the owner who wants to understand the idea and the developer who will build it.

How it works

1. A visitor types "red shoes under 2000?" into the chat on your website.
2. Our server matches the question to an action you switched on, and reads the details from the message: the words and the budget.
3. It calls your endpoint with those details, signed with your secret.
4. It checks your answer against the format, removes anything unknown and removes any HTML.
5. The visitor sees cards in the chat, usually in about a second if your API is fast.

If a required detail is missing, the chatbot asks for it in plain words, such as "Please share your order number", and then calls your API.

What you can connect, by industry

There are ready-made actions for 12 kinds of business. You build only the ones you switch on, and you can add your own.

What your developer builds

One URL handles every action, and the action name arrives in ?action=. The work is small:

1. In Dashboard → your chatbot → Live data, paste the https URL and choose your business type. Saving creates your secret, shown once.
2. Start from the PHP or Node.js starter code, which checks the signature and answers the verify call.
3. Press Verify endpoint. This proves you control the URL.
4. Add one block per action. Each action's page shows the format it expects, and Run test shows the card a visitor would see, with any problem named by its field.
5. Switch on the actions you built. Private ones also need the chatbot's allowed domains set.

The request and the answer

A public action is a signed GET with the details in the URL. A private action, such as order status, is a signed POST with the details in the JSON body, because a phone number in a URL ends up in access logs.

GET /rsflowhub?action=product_search&q=red+shoes&price_max=2000&limit=5 HTTP/1.1
Host: shop.example.com
X-RSFlowHub-Action: product_search
X-RSFlowHub-Timestamp: 1793923200
X-RSFlowHub-Signature: sha256=<hex hmac>

You answer with HTTP 200 and JSON. Only rsflowhub and status are always required, and fields we do not know are ignored and never reach a visitor.

{
    "rsflowhub": "1.0",
    "status": "ok",
    "type": "items",
    "data": {
        "items": [
            {
                "id": "sku-221",
                "title": "Red Running Shoes",
                "price": {
                    "amount": 1899,
                    "currency": "INR",
                    "compare_at": 2499
                },
                "availability": {
                    "state": "low_stock",
                    "label": "Only 3 left"
                },
                "url": "https://shop.example.com/p/red-running-shoes"
            }
        ]
    },
    "meta": {
        "next_cursor": "p2",
        "cache_seconds": 120
    }
}

There are five card types: a list of items, one item in full, where something stands, what is free and when, and a small table of facts. meta.next_cursor adds a Show more button. The docs list every status and field.

Security you should insist on

Connecting a chatbot to your systems is safe only if the connection is built carefully. Whichever product you use, ask about these points. This is how RSFlowHub handles them:

• Signed requests: every call carries an HMAC-SHA256 signature made with your secret and a timestamp, so your API can refuse anything else.
• A second proof for private data: a reference number alone is never enough. The visitor also gives a phone or email, your API checks both together, and a wrong phone and an unknown reference must get the same answer.
• The answer is checked: it is rebuilt from known fields only, with HTML removed, and only https links. Card, Aadhaar and PAN numbers in private answers are masked.
• The AI never sees private answers: a private answer goes to the visitor as a card and is not added to the AI's conversation.
• Nothing about the visitor is forwarded: no IP address, cookies or browser details reach your API.
• Your URL is guarded: https on port 443 and public addresses only, with no redirects, so the connection cannot be pointed at an internal server.
• It only reads: the chatbot does not book, cancel or change anything.

What happens when your API is down

A slow answer (over 4 seconds), a 500 error, a redirect or broken JSON counts as a failure. It is logged for you and never shown to the visitor. After that:

• A public question goes on to the normal chatbot, which is told not to state prices, stock or order status.
• A private question gets the fallback text you wrote, such as your support number. It never goes to the AI.
• If failures keep coming, calls pause for a while so your API can recover, and you get an email at most once an hour.

Why not let the AI call your API directly?

A common way to build this is function calling, where an AI model decides which API to call and writes the reply from the raw data. It is flexible, and for an internal tool it can be a good fit. For a public chat window it has real downsides: every lookup costs an AI call, the model sees your customers' data, and a clever message can try to steer which function runs with which values.

Here, the action and its details are read with fixed patterns and checked rules wherever possible, your answer is displayed as cards rather than rewritten, and private answers stay away from the model. The trade-off is that it answers the actions you set up, not any question about your data.

What it costs

Live data is available on the Starter plan and above. Each answer uses 1 credit, while a failed call or a private lookup that found nothing costs nothing. See the pricing page for current prices in rupees.

Related guides

Start with How to Add an AI Chatbot to Your Website, then read about lead capture and support tickets. See your industry on the AI chatbot by industry pages.

Frequently Asked Questions