Getting the most out of Parachute

Quick start

1. Sign in to the console and click Add a widget. Give it a name (e.g. your site).
2. Copy the embed code shown on the widget's Setup tab.
3. Paste it onto your site, just before the closing </body> tag.
4. A small "Feedback" tab appears in the corner. When a visitor sends a report, it lands in your inbox and in the console's Reports tab.

Installing the snippet

Parachute is one script tag with no dependencies. Drop it before </body>:

<script src="https://parachute.chat/parachute.js"
        data-key="sk_live_your_key" defer></script>

It works anywhere you can add HTML — WordPress, Squarespace, Webflow, Shopify, or a hand-coded site. The widget renders inside a Shadow DOM, so your site's styles can't break it and it can't leak into your page.

Optional attributes

Styling the button

On the widget's Setup tab you can set:

• Button label — e.g. "Feedback", "Report a bug", "Something wrong?"
• Accent color — match your brand (any hex color).
• Corner — bottom-right or bottom-left.
• Intro line — a short prompt shown above the message box.
• Ask for the reporter's email — adds an optional email field so you can follow up.

Changes take effect within about a minute — no need to touch the embedded site.

Where reports go

Every report is stored in your console and can be delivered two ways:

• Email — set one or more notify emails per widget. Reports arrive from reports@parachute.chat, and if the reporter left their email, hitting Reply goes straight to them.
• Webhook — POST each report to your own endpoint (see below).

In the console's Reports tab you can read each report with its page URL, browser, and screen size, and move it through new → triaged → closed.

Locking to your domains

By default a widget works on any site it's pasted into. To lock it down, add your domains under Allowed domains (e.g. acme.com, shop.acme.com). Then the widget only renders — and only accepts reports — on those domains and their subdomains. This stops anyone who copies your key from using it elsewhere.

Webhooks

Add a Webhook URL to a widget and Parachute POSTs a JSON body for every report:

{
  "event": "report.created",
  "site": "Acme storefront",
  "site_id": "…",
  "report": {
    "id": "…",
    "message": "The checkout button does nothing on Safari",
    "email": "shopper@example.com",
    "url": "https://acme.com/checkout",
    "user_agent": "…", "viewport": "1440x900",
    "referrer": "…", "app": "", "created_at": "2026-07-07T18:34:06Z"
  }
}

Each request includes a signature header so you can verify it really came from us:

X-Parachute-Signature: sha256=<hmac>

The HMAC is SHA-256 of the raw request body, keyed with your widget's signing secret (shown on the Setup tab). Verify it in Node like this:

const crypto = require("crypto");
const secret = process.env.PARACHUTE_SECRET;      // whsec_…
const sig = req.headers["x-parachute-signature"].split("=")[1];
const expected = crypto.createHmac("sha256", secret)
                       .update(rawBody)           // the exact bytes received
                       .digest("hex");
const ok = crypto.timingSafeEqual(
  Buffer.from(sig), Buffer.from(expected));
if (!ok) return res.status(401).end();

The kill switch

Every widget has an on/off toggle in the console. Flip it off and the widget disappears from your live site within about a minute — no redeploy of your site needed. Great for pausing during a launch or maintenance window.

Plans & the free tier

Blocking spam

Parachute defends the form on several layers, most of them invisible:

• Domain locking — set your allowed domains so a copied key is useless elsewhere.
• Rate limits — per-site, per-visitor, and a short burst cap.
• Honeypot — a hidden field bots fill and humans never see; those submissions are silently dropped.
• Anti-spam challenge — turn on the optional Cloudflare Turnstile check per widget if a site ever gets targeted.

Troubleshooting

The widget isn't showing up

• Make sure the widget is toggled on in the console.
• If you set Allowed domains, confirm the site you're viewing is on the list (or a subdomain of it).
• Check the data-key in your script tag matches the one in the console.
• Hard-refresh — config is cached for about a minute after changes.

I'm not getting report emails

• Check the notify emails on the widget's Setup tab.
• Look in spam/promotions for mail from reports@parachute.chat.
• On Free, the email is a short notification — the full text lives in the console.

Still stuck?

Use the Parachute tab in the corner of this page to send us a report — it's the same widget, and it comes straight to us. 🪂