Requires a proxied (orange-cloud) zone
Grey-cloud DNS-only records bypass Cloudflare's edge entirely — Snippets never see those requests. Use one of the CMS-side install paths in that case.
If your domain is proxied through Cloudflare (orange cloud), you can inject the widget on every HTML response with a single Snippet — no theme edit, no plugin install, no deploy.
Cloudflare Snippets injects the OrcaLinq script into your HTML at the edge — before the browser ever sees the page. You don't need theme code access, a CMS plugin slot, or a deploy. Any site already proxied through Cloudflare (orange-cloud DNS) can install the widget in under a minute.
Sign up free — passwordless sign-in by email, no credit card. The free plan includes the website widget and a sandbox tenant.
chat_…). You'll paste it into the Snippet body below.Snippets only run on traffic Cloudflare sees. Your DNS records for the hostname must be proxied (orange cloud), not DNS-only (grey cloud). If you're using Cloudflare Pages or Workers your traffic is already proxied — skip ahead.
aichat-widget.PASTE_YOUR_chat_KEY_HERE with the Tenant Key from Step 1.(http.host eq "yourdomain.com") — replace with your actual hostname.This Snippet uses Cloudflare's HTMLRewriter streaming HTML parser to append the widget tag inside <head> on every HTML response. Non-HTML responses (CSS, JS, images, JSON) pass through untouched.
export default {
async fetch(request, env, ctx) {
const response = await fetch(request);
// Only touch HTML responses. Cloudflare's HTMLRewriter ignores
// non-HTML bodies automatically, but short-circuiting here keeps
// CPU usage at zero for the 90%+ of edge traffic that's assets.
const ct = response.headers.get("content-type") || "";
if (!ct.includes("text/html")) return response;
// Inject just before </head>. Use a per-domain Tenant Key — copy
// it from Dashboard → Domains → Installation → Per-domain widget
// API key. Each domain on your tenant has its own key.
const TENANT_KEY = "PASTE_YOUR_chat_KEY_HERE";
const WIDGET_SRC = "https://api.orcalinq.com/w.js";
const API_BASE = "https://api.orcalinq.com";
const tag = '<script async src="' + WIDGET_SRC +
'" data-tenant="' + TENANT_KEY +
'" data-api="' + API_BASE + '"><\/script>';
return new HTMLRewriter()
.on("head", {
element(el) { el.append(tag, { html: true }); },
})
.transform(response);
},
};
Replace PASTE_YOUR_chat_KEY_HERE with your per-domain Tenant Key (from Dashboard → Domains → Installation → Per-domain widget API key). The WIDGET_SRC and API_BASE are already filled in for your tenant.
data-tenant= — the tag must be present in the raw HTML, not just the live DOM. That confirms Snippets injected server-side.Grey-cloud DNS-only records bypass Cloudflare's edge entirely — Snippets never see those requests. Use one of the CMS-side install paths in that case.
Snippets is generally available with a generous monthly request allowance on the Free plan. Higher-traffic sites should review pricing in the Cloudflare dashboard — Snippet invocations are cheap but not free at scale.
If you already run a Cloudflare Worker on the zone, you can do the same HTMLRewriter injection inside the Worker. Snippets is just the no-Worker shortcut.
Snippets runs after origin fetch and before caching. The injected tag is part of the cached HTML, so cache hits also get the widget — no per-request injection cost on cache hits.
No. Cloudflare Snippets is a Cloudflare-side change — your origin server, CMS, and theme are untouched. The Snippet starts injecting the tag within ~30 seconds of clicking Deploy, globally.
If your origin sends a strict CSP, you need to allow the widget host in <code>script-src</code> and the API host in <code>connect-src</code>. The dashboard's <em>Strict CSP?</em> panel lists the exact origins. Snippets doesn't bypass CSP — the browser still enforces it.
Cloudflare dashboard → Rules → Snippets → delete or disable the <code>aichat-widget</code> snippet. The widget stops loading on the next request (cached HTML pages serve the old tag until they expire — usually minutes).
Yes. The Pages project's custom domain is a normal Cloudflare zone — add the Snippet on that zone. For the <code>*.pages.dev</code> preview URL there's no zone-level Snippets surface; use a Cloudflare Worker bound to the Pages project instead.
Open <strong>Domains → Installation → Diagnose</strong> in your <a href="https://app.orcalinq.com">tenant admin portal</a> for a live install check, or contact support.