Getting the most out of Parachute

Quick start

1. Sign in to the console and click + New widget. Give it a name (e.g. your site).
2. Copy the embed code shown on the widget's Setup tab.
3. Paste it onto your site, just before the closing </body> tag.
4. A small "Feedback" tab appears in the corner. When a visitor sends a message, it lands in your Inbox in the console (and by email).

Installing the snippet

Parachute is one script tag with no dependencies. Drop it before </body>:

<script src="https://parachute.chat/parachute.js"
        data-key="pc_live_your_key" defer></script>

It works anywhere you can add HTML — WordPress, Squarespace, Webflow, Shopify, or a hand-coded site. The widget renders inside a Shadow DOM, so your site's styles can't break it and it can't leak into your page.

Optional attributes

Styling the button

On the widget's Setup tab you can set:

• Button label — e.g. "Feedback", "Report a bug", "Something wrong?"
• Accent color — match your brand (any hex color).
• Corner — bottom-right or bottom-left.
• Intro line — a short prompt shown above the message box.
• Form fields — set the Name and Email fields to Off, Optional, or Required. The message box is always there.

Changes take effect within about a minute — no need to touch the embedded site.

Guided conversation flow

Instead of one blank box, you can open with a friendly question and a few choices — "Something's broken", "I have an idea", "Talk to the team" — each leading to a tailored follow-up. It's optional, set per widget under Conversation flow.

• Each choice has a type (bug, idea, question, lead) that sets its icon and tags the message.
• "Talk to the team" messages are treated as leads and can route to a separate email.
• Turn on Auto-sort with AI and each message is classified (bug / lead / question), given an urgency flag, and a one-line summary — automatically.

Your inbox

Every message is stored in your console and can be delivered two ways:

• Email — set one or more notify emails per widget. Messages arrive from reports@parachute.chat, and if the visitor left their email, hitting Reply goes straight to them.
• Webhook — POST each message to your own endpoint (see below).

In the console's Inbox tab you read each message with its page URL (clickable), browser, and screen size, then give it a disposition: Passed along (you forwarded it), Added to a system (you logged it in your tools), or Done. "New" is the only thing that needs your attention — everything else is a way of clearing it. Links in a message are clickable, and any attached screenshot opens full-size in a click.

Every Monday you also get a weekly digest email — a recap of what came in, leads to chase, and your busiest widgets. Turn it off anytime from the console (or the unsubscribe link in the email).

AI assists Pro

Parachute has a few one-click helpers built into the inbox, so you spend less time on the busywork:

• Draft reply — writes a warm, ready-to-send reply to any message or lead. Edit it, then copy or fire it off by email.
• Summarize — a quick briefing of everything new: the themes, the counts, and any hot leads.
• Group similar — spots messages describing the same issue, so five "it's broken" reports collapse into one thing to fix.

These run on your paid plan; usage is metered and tiny (fractions of a cent per call).

Routing & leads

People take the path of least resistance — so your feedback widget quietly becomes your fastest contact form. Routing rules make sure the right messages reach the right place the second they arrive.

In a widget's Setup tab, turn on Auto-route messages and add rules — each is simply "when a message is X → send it to Y."

• Match by kind — Leads, Bugs, Ideas, Questions, Other, or Any message.
• Send to — one or more email addresses and/or a Slack channel (paste an Incoming Webhook URL). Your widget's main webhook still fires for every message.
• Rules are additive — a lead can go to sales and your #feedback Slack at once.

Data capture & privacy

Parachute can gather the context you need to actually reproduce a bug — turned on per widget, and scrubbed for personal data in the visitor's own browser before anything is sent to us.

• Environment signals (all plans) — screen size, language, timezone, connection, light/dark. No permissions, no prompts.
• JS errors & breadcrumbs (Pro+) — the actual error + stack trace, plus the visitor's recent clicks and page changes, so you see what broke.
• Screenshot (Pro+) — the visitor can grab and circle a picture of the page. It's a redraw of the page (no camera, only that page), and sensitive fields are masked before it's saved.
• Your own tags — call Parachute.identify({ userId, plan }) on your page to attach whatever context you like to each message.

Locking to your domains

By default a widget works on any site it's pasted into. To lock it down, add your domains under Allowed domains (e.g. acme.com, shop.acme.com). Then the widget only renders — and only accepts reports — on those domains and their subdomains. This stops anyone who copies your key from using it elsewhere.

Webhooks

Add a Webhook URL to a widget and Parachute POSTs a JSON body for every report:

{
  "event": "report.created",
  "site": "Acme storefront",
  "site_id": "…",
  "report": {
    "id": "…",
    "message": "The checkout button does nothing on Safari",
    "email": "shopper@example.com",
    "url": "https://acme.com/checkout",
    "user_agent": "…", "viewport": "1440x900",
    "referrer": "…", "app": "", "created_at": "2026-07-07T18:34:06Z"
  }
}

On Pro+ widgets with diagnostics on, the report also carries env, metadata (your identify() tags), errors, and breadcrumbs.

Each request includes a signature header so you can verify it really came from us:

X-Parachute-Signature: sha256=<hmac>

The HMAC is SHA-256 of the raw request body, keyed with your widget's signing secret (shown on the Setup tab). Verify it in Node like this:

const crypto = require("crypto");
const secret = process.env.PARACHUTE_SECRET;      // whsec_…
const sig = req.headers["x-parachute-signature"].split("=")[1];
const expected = crypto.createHmac("sha256", secret)
                       .update(rawBody)           // the exact bytes received
                       .digest("hex");
const ok = crypto.timingSafeEqual(
  Buffer.from(sig), Buffer.from(expected));
if (!ok) return res.status(401).end();

The kill switch

Every widget has an on/off toggle in the console. Flip it off and the widget disappears from your live site within about a minute — no redeploy of your site needed. Great for pausing during a launch or maintenance window.

Plans & the free tier

Blocking spam

Parachute defends the form on several layers, most of them invisible:

• Domain locking — set your allowed domains so a copied key is useless elsewhere.
• Rate limits — per-site, per-visitor, and a short burst cap.
• Honeypot — a hidden field bots fill and humans never see; those submissions are silently dropped.
• Anti-spam challenge — turn on the optional Cloudflare Turnstile check per widget if a site ever gets targeted.

Troubleshooting

The widget isn't showing up

• Make sure the widget is toggled on in the console.
• If you set Allowed domains, confirm the site you're viewing is on the list (or a subdomain of it).
• Check the data-key in your script tag matches the one in the console.
• Hard-refresh — config is cached for about a minute after changes.

I'm not getting notification emails

• Check the notify emails on the widget's Setup tab.
• Look in spam/promotions for mail from reports@parachute.chat.
• On Free, the email is a short notification — the full message lives in the console.

Still stuck?

Use the Parachute tab in the corner of this page to send us a report — it's the same widget, and it comes straight to us. 🪂