Mint API keys and install the quote widget

Two different keys do two different jobs here: an MCP API key for your own integrations, and a publishable widget key for the Quote widget on your site. Don't confuse them — the widget key is deliberately narrow-scoped, and each is minted from a different console.

Steps

1. Manage your own MCP API keys. Go to MCP Console → Keys (Agents & Webhooks group in the /os console nav) to mint, rotate, and revoke keys for your own integrations or agent tooling. Here you choose read or read/write scope — this console does not mint the widget's narrow scope, so it isn't the place to get a widget key.

2. Mint your publishable widget key. Go to Quote Desk → Widget, open the Keys tab, and mint a key with the "Publishable widget key (lead capture)" type. This is self-service — you don't need to wait on onboarding or ask the Obsidian Jet team for one. The plaintext key is shown once, at mint time; save it immediately, because it can't be recovered later. If you lose it, mint a new one and update your site.

3. Copy the install snippet. Still on the Widget page's Widget tab, configure the widget's look and prefill options, then copy the generated snippet from the panel below it. It always ships with a placeholder in place of the real key:

   <!-- Obsidian Jet Quote widget -->
   <div id="obsidian-jet-quote"
        data-tenant="your-slug"
        data-api-key="YOUR-WIDGET-KEY"></div>
   <script src="https://cdn.obsidianjet.com/embed.js" async></script>

   Replace YOUR-WIDGET-KEY with the key you minted in step 2, and drop the snippet where the quote form should appear on your site.

4. Verify the install. The Widget page's install-state indicator reflects the server's own record of the widget key's first authenticated request — it is never self-attested, so it only flips once your site has actually called in. If the host <div> is missing data-tenant, the widget shows an honest configuration notice instead of a quote form rather than failing silently.

5. Allow your site's origin. The widget's requests are blocked by CORS until your site's origin is added to your tenant's allow-list. There is no self-service UI for this yet — ask the Obsidian Jet team to add your site's origin.