FAQ
Can I deploy Invero behind a login?
Yes, you can deploy behind a login.
- The Website widget is most commonly integrated in public documentation sites but it can also be integrated into web pages behind a login.
- The Support Form Deflector can be integrated into both public support forms and those behind a login.
- You can leverage the API to power your own interfaces irrespective of where they are integrated.
How do I fix CORS errors?
CORS (Cross-Origin Resource Sharing) is a security mechanism that controls which domains can access resources from Invero's servers.
How CORS affects your Invero integration
When your website (e.g., yourdomain.com) makes requests to Invero's services (e.g., proxy.invero.ai), these are considered "cross-origin" requests. Without proper CORS configuration:
- The browser blocks these requests
- Your Invero Website Widget won't function
- Users see CORS errors in their browser console
What CORS errors look like
Access to fetch at 'https://proxy.invero.ai/...' from origin 'https://yourdomain.com' has been blocked by CORS policy
How to fix
You don't need to modify your own server's CORS settings. Instead:
- In the Invero platform, add your domain to the enabled domains list when configuring your integration
- This tells Invero's servers to allow requests from your domain
- This prevents CORS errors in your integration
How do I fix CSP errors?
CSP (Content Security Policy) is a security feature that you configure on your website to specify which external resources your site is allowed to use.
How CSP affects your Invero integration
When you add the Website Widget or the Support Form Deflector to your site, your CSP needs to allow:
- Scripts from Invero and your CAPTCHA provider
- API connections to Invero's services
- Frames for the CAPTCHA challenge
- Inline styles for the widget
- Images for file uploads, source favicons, and images from your documentation
Without proper CSP configuration:
- Scripts from Invero won't load
- API requests to Invero services are blocked
- Users see CSP violation errors in their browser console
What CSP errors look like
Refused to load the script 'https://widget.invero.ai/...' because it violates the following Content Security Policy directive: "script-src 'self'"
How to fix
If your website has a Content Security Policy enabled, allow these domains:
| Domain | Purpose | CSP directives |
|---|---|---|
https://widget.invero.ai | Loading the widget script | script-src |
https://proxy.invero.ai | Proxy for widget functionality | connect-src |
https://invero-widget-proxy-la7dkmplpq-uc.a.run.app | Fallback for the main proxy | connect-src |
https://metrics.invero.ai | Browser fingerprinting (only if enabled) | script-src, connect-src |
https://www.google.com/recaptcha/, https://www.gstatic.com, https://recaptcha.google.com | reCAPTCHA (default) | script-src, frame-src |
https://hcaptcha.com, https://*.hcaptcha.com | hCaptcha (only if enabled) | script-src, connect-src, frame-src, style-src |
https://storage.googleapis.com/invero-file-uploads/ | File uploads | connect-src, img-src |
blob: | Previews of attached files before upload | img-src |
https://www.google.com, https://*.gstatic.com | Favicons for sources | img-src |
'unsafe-inline' | Widget styles | style-src |
The widget injects its styles inline, so style-src must include 'unsafe-inline'. The widget does not support CSP nonces.
The widget loads only one CAPTCHA provider. By default, it uses reCAPTCHA, and you can leave the hCaptcha domains out of your policy. If you set data-bot-protection-mechanism to "hcaptcha", you need the hCaptcha domains instead, and you can leave out the reCAPTCHA domains in script-src and frame-src. Keep https://www.google.com in img-src for source favicons.
You only need https://metrics.invero.ai if you enable browser fingerprinting with data-user-analytics-fingerprint-enabled="true".
Answers can include images from your documentation. Add the domains that host those images to img-src.
Example policy as a meta tag:
<meta
http-equiv="Content-Security-Policy"
content="
script-src 'self' https://widget.invero.ai https://metrics.invero.ai https://www.google.com https://www.gstatic.com https://hcaptcha.com https://*.hcaptcha.com;
connect-src 'self' https://proxy.invero.ai https://invero-widget-proxy-la7dkmplpq-uc.a.run.app https://metrics.invero.ai https://hcaptcha.com https://*.hcaptcha.com https://storage.googleapis.com/invero-file-uploads/;
frame-src 'self' https://www.google.com https://recaptcha.google.com https://hcaptcha.com https://*.hcaptcha.com;
style-src 'self' 'unsafe-inline' https://hcaptcha.com https://*.hcaptcha.com;
img-src 'self' blob: https://storage.googleapis.com/invero-file-uploads/ https://www.google.com https://*.gstatic.com
"
/>
Or as an HTTP header:
Content-Security-Policy: script-src 'self' https://widget.invero.ai https://metrics.invero.ai https://www.google.com https://www.gstatic.com https://hcaptcha.com https://*.hcaptcha.com; connect-src 'self' https://proxy.invero.ai https://invero-widget-proxy-la7dkmplpq-uc.a.run.app https://metrics.invero.ai https://hcaptcha.com https://*.hcaptcha.com https://storage.googleapis.com/invero-file-uploads/; frame-src 'self' https://www.google.com https://recaptcha.google.com https://hcaptcha.com https://*.hcaptcha.com; style-src 'self' 'unsafe-inline' https://hcaptcha.com https://*.hcaptcha.com; img-src 'self' blob: https://storage.googleapis.com/invero-file-uploads/ https://www.google.com https://*.gstatic.com;
Summary: CORS vs CSP
CORS settings (in Invero) control who can access Invero's services, while CSP settings (on your website) control what external resources your site can use. Both need to be configured correctly for Website Widgets to function properly.
For a successful Invero integration:
- CORS configuration: Add your domain to the enabled domains list in the Invero platform
- CSP configuration: Update your website's Content Security Policy to include the Invero domains
Can I attach files and images to my questions?
The Website Widget, Internal Technical Assistant and Slack Bot allow users to attach files to their questions. Invero uses the uploaded content as additional context when formulating its response, helping provide more accurate and relevant answers.
The Support Form Deflector does not read files from a support form's attachment field. Its answers can still use files that are already indexed in your knowledge sources.
Supported file types
PDF
Images
.jpg & .jpeg
.png
Text-based
.adoc
.bash
.bat
.bib
.c
.cc
.cfg
.cmake
.conf
.cpp
.css
.csv
.dockerignore
.editorconfig
.fish
.gitattributes
.gitignore
.go
.gpx
.graphql & .gql
.h
.hpp
.html
.ini
.java
.jl
.js
.json
.jsonl
.jsx
.kml
.kt
.less
.log
.m
.md
.mdx
.n3
.ndjson
.ninja
.org
.php
.properties
.proto
.ps1
.py
.r
.rb
.rdf
.rs
.rst
.rtf
.scss
.sh
.sql
.swift
.tex
.toml
.ts
.tsv
.tsx
.ttl
.txt
.xml
.xsd
.xsl
.xslt
.yaml & .yml
.zsh
Dockerfile
Makefile
How do I view user analytics?
All Prebuilt Agents except the Zendesk Agent track users anonymously by default and can be configured for non-anonymous tracking with email or custom identifiers.
| Integration | Anonymous tracking | Non-anonymous tracking |
|---|---|---|
| Website Widget | First-party cookie (invero_web_id) | Email or custom ID via window.inveroSettings |
| Support Form Deflector | First-party cookie (invero_web_id) | Email from form fields or window.inveroSettings |
| Slack Bot | Slack user ID | Email collection via users:read.email scope |
| Discord Bot | Discord user ID | Email collection when enabled |
| Internal Technical Assistant | Invero account identity | Company email via Google Sign-In |
| MCP Server | Opaque OAuth user ID | Email or custom ID via _meta field (API key mode) |
Once user tracking is in place, team members and administrators can analyze user activity and conversation data on the Invero platform:
- Users dashboard: Navigate to Users in the left sidebar to view all tracked users, their activity metrics, and conversation history
- User filtering: Search by email or ID. Use the Type filter to show all users, anonymous users, or identified users.
- Conversation analysis: Click "View conversations" for any user to see their complete interaction history
- User context in conversations: When reviewing conversations, user IDs are displayed in the details panel, allowing you to see which user submitted a question
You can also use the Export feature, available on both the Users and Conversations screens, to export conversation or user data as CSV for processing in external systems.
Can Invero help users with code?
Yes, Invero can help your users understand and write code. Most technical knowledge sources indexed by Invero contain code, often usage examples or tutorials, and you can index repositories directly with the GitHub Code connector. Invero leverages the code it has indexed to help your users with coding related questions, commonly assisting with debugging, explaining, and extending their code. However, Invero is not a general coding assistant: it only reasons over and writes code that is related to your product or project as defined by your knowledge sources.
What LLM models does Invero use?
Invero is model-agnostic and works with multiple model providers, including OpenAI, Anthropic, Cohere, and Voyage, selecting the best-performing model for each task. To ensure data privacy and security, we have DPAs and training opt-outs with all providers we work with. The same applies across every Prebuilt Agent and the retrieval engine underneath them.
Can I control the length of Invero's responses?
No. Invero is optimized for providing accurate, context-specific answers to technical product questions through our answer engine. The response length is determined by the amount of relevant information needed to fully and accurately answer the question. While you can technically apply additional prompting to change response length, we strongly recommend against doing so as it will compromise the accuracy and completeness of answers. This approach aligns with our core mission of providing the most accurate responses.
How do I get my project ID?
In the Invero platform, click on Manage projects in the project dropdown menu to navigate to the project management screen. Here you can find the id for each of your projects.