Central AI is an AI-powered chatbot and CRM platform that automates customer conversations, captures and qualifies leads, and manages your AI knowledge base using data from CSVs, PDFs, web URLs, and APIs.

How does Central AI learn about my business?

You upload CSVs, PDFs, or connect your website and APIs. Central AI processes this data into a vector database so the AI chatbot can provide accurate, context-aware responses based on your content, answering just like your team using your latest business data.

Does Central AI integrate with Odoo CRM?

Yes, Central AI has native integration with Odoo CRM, so the AI chatbot can sync leads, notes, and activities directly into your existing Odoo pipelines.

Is my data secure with Central AI?

Central AI uses a multi-tenant architecture with strict data isolation. Your documents are encrypted, never shared with other customers, not used to train external models, and the platform is designed for secure handling of sensitive business and customer data.

Is there a free plan?

Yes, you can start with a free Test Drive plan and then upgrade to paid plans as your usage and feature needs grow.

Why is Central AI better than traditional AI chatbot services?

Central AI is built as a full AI chatbot and CRM revenue engine, not just a chat widget. It automatically captures leads from every conversation, categorizes them by intent and segment, syncs them into Odoo and other CRMs, and can securely share unmatched leads with partner companies. At the same time, it automates both support and sales flows across web and messaging channels, turning routine chats into trackable pipeline and real business outcomes instead of isolated bot sessions.

Security and keys

Which key is public, which is secret, and how your data is kept apart.

On this page: Your keys · Every credential · Rotating keys · Allowed domains · How your data is kept apart · Good practice

Your two keys

You have two keys and they are not interchangeable. Both are on Security in the dashboard (under Embed & API).

Widget key · ca_… · public

Sent by the chat widget snippet. Begins with ca_. It is in your page source by design, and your allowed domains are what protect it. It is not accepted by any server-to-server API after the sunset date.

External API key · cax_… · secret

The secret key for every server-to-server API. Begins with cax_. Call these APIs from your own server only. Only administrators and teammates with Agent Configuration access can see it.

Why two: the widget key is printed in your page source, so anyone can read it. Everything called from a server (reading conversations, syncing knowledge or offerings, reporting won leads, reading tickets) can reveal or change your business data, so none of it accepts a key that is published on a public page. Since 19 October 2026 the widget key is refused by every server API.

Every credential

Credential	Header	Kind	What it is
External API key	`X-API-Key`	secret	The secret key for every server-to-server API. Begins with cax_. Call these APIs from your own server only.
Widget key	`X-Widget-Key`	public	Sent by the chat widget snippet. Begins with ca_. It is in your page source by design, and your allowed domains are what protect it. It is not accepted by any server-to-server API after the sunset date.
Shopper token	`X-Shopper-Token`	issued	Minted by Central AI for one visitor's browser and sent back by the widget. It ties a conversation to that browser. You never create or send it yourself.
Site id	`X-Site-Id`	public	Sent by the visitor tracker snippet. Public, like the widget key; your allowed domains protect it.
Connector URL	in the URL	secret	The secret is part of the URL itself. Treat the URL like a password.
Connector shared secret	`X-Central-Secret`	secret	Optional. When you set one on a connector, every request to it must carry it.
Commerce API key (yours)	`Authorization`	secret	A secret your own system issues for Central AI. Central AI sends it as Authorization: Bearer <key> on every call to your system.
RFC 9421 signature	`Signature`	issued	Every call between Central AI and your system is signed (Signature-Input, Signature and, with a body, Content-Digest). You verify ours with the public key at /.well-known/ucp; we verify yours with the key pinned when you published the connection.

public: in your page source by design; secret: never in a browser; issued: created by the system, never by you.

Live checkout order webhook secret (secret): signs the order messages your server sends to Central AI, in the Central-AI-Signature header. Generated in section 3 of the AI Sales Agent settings and shown once. See Live checkout.

Rotating keys

Widget key: Regenerate on Security. The old key stops working at once, so paste the new snippet on every page straight away. Your administrators are notified.
External API key: Regenerate on Security. Calls with the old key are refused at once; update your servers first. Your administrators are notified.
CRM connector URL: rotate it on the Won Leads page. The old URL then answers as if it never existed.
Commerce API key (the one your system issued for Central AI): in the AI Sales Agent settings, turn on Advanced in section 3, enter the new key in Connection to your system, then press Save connection, Publish connection revision and Test connection.
Live checkout order webhook secret: Rotate the secret in section 3 (Live checkout). The old one keeps working for 24 hours so your server can switch; press Stop the old secret now if it may have leaked. Only a company admin can do this.

Allowed domains

The widget, the Chat API and the lead capture tracker answer only for origins on your allowed-domains list, and an empty list allows nothing. Matching is by whole domain name, so a look-alike domain never matches. See Allowed domains for the exact rules.

How your data is kept apart

Every record belongs to one company. Knowledge, offerings, conversations, leads, tickets, integrations and requests are stored with your company and every screen and API reads only your company’s rows. Asking for another company’s ticket, suggestion or offering by its id is answered as not found.
Your knowledge is searched only in your own space. The vectors your agent searches are stored in a namespace of your company’s own; another company’s agent never searches it.
Central AI’s own assistant is separate. The assistant on Central AI’s website has its own knowledge and never reads yours.
Each visitor’s chat belongs to their browser. The widget ties a conversation to a token issued for that browser, so one visitor cannot open another’s conversation.
Secrets you give us are encrypted. The access Meta grants for your Page or number is stored encrypted, and so are the Commerce API key your system issued and the live checkout order webhook secret; neither is shown again after it is saved or first shown.
Nothing is sold that you did not approve. Suggestions from Find what I sell change nothing until you approve them. An order taken in a social chat needs the customer’s confirmation code, and a live checkout order is placed by the customer on your own site.

Good practice

Keep the external API key in an environment variable or a secrets manager on your server. Never commit it.
List only the domains you actually use, and remove old ones.
Give teammates only the access they need (Team page); only administrators and Agent Configuration can see the external API key.
If a key may have leaked, regenerate it straight away.

Signed in? Your own keys, endpoint addresses and the full error tables are on the API reference inside your dashboard. These public pages never show anyone’s key: examples use placeholders such as YOUR_EXTERNAL_API_KEY.