Skip to main content
Every client surface reaches flows through one of two access tiers. Keeping them distinct is central to AICO’s security model.

​
The two tiers

​
Anonymous embed — the widget

The <aico-flow> web component embeds a flow on any site: text chat with streamed replies, file attachments, and an in-place upgrade to a live voice conversation. The browser extension packages the same widget for use on any page. Anonymous identity is a three-step ladder:
  1. Per-tab session (default) — an opaque session ID scoped to the browser tab. Nothing persists after the tab closes.
  2. Persistent pseudonym (opt-in per flow) — a client-stored anonymous ID so returning visitors continue with context. Off by default (shared-terminal safety); intended to be tied to your cookie-consent flow.
  3. Signed identity — your backend signs the visitor’s user ID with a per-organization secret (HMAC); the widget forwards the token, and AICO verifies it. This names your user without any AICO login. When a signed identity appears, memory accumulated under the pseudonym is merged into it.
The embed is protected server-side: web access must be explicitly enabled per flow, requests are checked against the flow’s origin allowlist, and per-visitor and per-IP rate limits apply.

​
Authenticated clients

Native clients authenticate once via the device grant (type a short code in any browser), then hold an organization-scoped token. Signed-in clients get:
  • Flow sessions attributed to the user, with persistent memory
  • Coworker calling — a directory of callable colleagues, device-to-device calls with ring / accept / decline on every surface including the wearable’s display
  • Call invitations — a running flow can ring a person (consult, relay, handoff) and the invitation appears on all their devices; first answer wins
  • Offline clips — audio captured without connectivity uploads in the background and runs as flow turns when the network returns

​
Server-to-server

For backends and integrations, API keys replace user login: self-contained signed tokens, scoped to an organization and a set of permissions, with optional expiry, one-call rotation, and revocation. Use them for the trigger endpoint, scheduled runs, and CI. See Security for details.