Muchat – AI Chatbot

Muchat AI connects your WordPress site to an Agent managed in Muchat. Select Connect, sign in to your Muchat account, and choose an Agent to add its AI chat widget. The plugin also provides authenticated access to site content and live WooCommerce order tracking for a connected Muchat service.

Version 3.0 includes:

• A secure authorization-code connection with PKCE and an Agent picker on Muchat.
• Connection health, last-check information, and separate statuses for the widget, site data, and order tracking.
• A local, asynchronous widget loader using the Agent’s public website token.
• Path-based rules that show the widget everywhere except selected paths, or only on selected paths.
• Optional signed identity for logged-in WordPress members. It sends the WordPress user ID, display name, and email only after an administrator enables this setting.
• Authenticated data endpoints for WordPress posts, pages, and WooCommerce products, with pagination and modification filters for Muchat synchronization.
• Live WooCommerce order tracking for guests and signed-in customers, including order status, purchased items, totals, and shipping methods.
• A native, translation-ready WordPress administration screen with bundled Persian translations and RTL-friendly presentation.

Widget appearance, greetings, persona, business hours, and order-tracking actions are managed in Muchat. Content synchronization is performed by the connected Muchat service using the plugin’s authenticated data endpoints; the plugin does not start an independent synchronization job when it is activated.

A Muchat account and an HTTPS single-site WordPress installation are required. WooCommerce is optional for chat and WordPress content access, and is required for product data and order tracking. WordPress Multisite is not supported in version 3.0.

External services

This plugin connects to the Muchat hosted service. Muchat provides the account login, Agent selection and management, connection provisioning, verification, and visitor chat widget that make the plugin useful. No connection request is made merely by activating a fresh installation.

When a WordPress administrator selects Connect or Reconnect, the plugin sends API requests to https://api.mu.chat and opens the account and Agent selection flow at https://app.mu.chat. These requests contain the site’s canonical HTTPS URL, an installation UUID, the exact WordPress callback and REST handshake URLs, WordPress/plugin/protocol versions, the administrator’s WordPress interface locale, and temporary authorization security values (state and a PKCE challenge). The administrator’s browser is then sent to Muchat to sign in and select an Agent. Muchat returns a one-time authorization code to WordPress, and the plugin exchanges it server-to-server for installation credentials. Muchat contacts the registered muchat-sync/v1/handshake REST URL to verify that the connection is reachable. These transfers are necessary to connect the selected Agent and verify the site.

After an Agent is connected and the widget is enabled on the current path, the visitor’s browser downloads https://widget.mu.chat/sdk.js and communicates with https://widget.mu.chat. Like other web services, Muchat receives network and browser information needed to serve the widget, including the visitor’s IP address, request headers, and the URL of the page where the widget runs. Muchat also receives chat messages and any information the visitor chooses to submit in the chat. These transfers are necessary to display and operate the Muchat chat service.

Signed member identity is disabled by default. If a site administrator enables it, the plugin sends Muchat a short-lived signed token containing the WordPress user ID and its site/Agent binding, the logged-in member’s WordPress display name, and email address. It does not send the username, password, role, phone number, or custom profile fields. If token creation fails, the widget continues anonymously.

After connection verification, Muchat can request posts, pages, and, when WooCommerce is active, products from the site’s authenticated data endpoints. These responses include the content and product fields exposed by the plugin for synchronization with Muchat. The endpoints require the installation credential and its data-access scope.

When order tracking is configured in Muchat, the service sends an authenticated lookup to the site’s muchat-commerce/v1/orders/track endpoint. Guest lookups require an order number and matching email or phone information. Signed-in lookups require the optional member identity feature. Responses include matching order statuses, dates, item names and quantities, totals, payment method labels, and shipping methods. Default responses exclude billing/shipping addresses, contact details, payment links, order keys, and internal notes. Store code can customize the returned order details through the plugin’s filter. This exchange is used to answer the customer’s order inquiry.

Muchat service terms: https://app.mu.chat/terms

Muchat privacy policy: https://app.mu.chat/privacy

Muchat documentation: https://docs.mu.chat/

Privacy

The plugin stores a site UUID, connection status, selected Agent summary, public widget token, visibility preferences, and encrypted/hashed credential material in WordPress options. Uninstalling the plugin removes its version 3 options and temporary connection data locally; it does not delete chats, Agents, or other data held in the Muchat account.

The widget can send the current page URL and visitor chat activity to Muchat as described under External services. Optional logged-in member identity sends the WordPress user ID, display name, and email only when enabled by a site administrator. A verified connection also allows scoped content requests and authorized order lookups as described above. Order responses use private, no-store cache headers. Site owners are responsible for providing any notices or consent required for their visitors and jurisdiction.

For Muchat’s handling of service data, see https://app.mu.chat/privacy.