DocsStore platforms

Noli on WooCommerce.

The WordPress plugin adds the Noli chat widget to your storefront and signs logged-in WooCommerce customers into it automatically - no second login, no lost session.

Install the plugin

  1. Upload it to WordPress

    Copy the noli-loyalty/ folder into wp-content/plugins/, or zip it and use Plugins → Add New → Upload Plugin.

  2. Activate "Noli Loyalty & AI Chat"

    It appears in your plugin list like any other.

  3. Paste your two keys

    Go to Settings → Noli Loyalty and fill in the publishable key and the signing secret. Both are issued in the Noli admin under Settings → Embed on any site.

  4. Connect the WooCommerce API (optional but recommended)

    In the Noli admin, connect your store's WooCommerce API. Without it, rewards still work - the customer just gets a code to type instead of a one-click apply.

The panel below the form spells out where to generate the WooCommerce REST API keys.

That is the whole install. The widget appears on the storefront immediately: guests can chat and sign in with an email code, and signed-in customers are recognised on sight.

Screenshot pending/docs/woocommerce/wp-settings.webpWordPress Settings screen for the Noli Loyalty plugin with both key fields
Settings → Noli Loyalty. The signing secret is stored server-side and never rendered on the storefront.

How seamless login works

On each storefront page load for a logged-in customer, the plugin mints a short-lived HS256 JWT containing their email, name and an expiry, signed server-side with your signing secret. It emits:

<script>window.NoliConfig={widgetKey:"pk_live_…", identityToken:"<jwt>"};</script>
<script async src="https://app.heynoli.ai/widget/v1/noli-widget.js" data-noli-key="pk_live_…"></script>

The widget posts that token to Noli's identify endpoint, which verifies the signature with your secret, mints a loyalty session and signs the customer in. The token expires in five minutes and is verified server-side; the secret itself never reaches the browser.

⚠️

Keep the signing secret server-side. The plugin never prints it - it only emits signed, short-lived tokens. If you build your own integration instead of using the plugin, sign on the server. A secret in page source lets anyone mint an identity for any of your customers.

Rewards and coupon auto-apply

When a customer redeems a reward or converts points in the chat, Noli creates a real WooCommerce coupon - provided you connected the WooCommerce API - and the chat shows an Apply button pointing at:

https://your-store.com/?noli_coupon=CODE

The plugin catches that parameter, applies the coupon to the cart and redirects to the cart page, so the discount lands in one click. With no WooCommerce API connected, the customer simply receives the code to enter at checkout.

Security notes

  • The publishable key is safe in page source, like a Stripe pk_. It unlocks read and chat only.
  • The signing secret must stay server-side. It is what proves a customer is who the page says they are.
  • Pin your domains in the allowed-origins list on the Noli Embed page once you are live - it limits the damage if a key ever leaks.

If you are not using the plugin

A WordPress site without WooCommerce, or one where you would rather not add a plugin, can use the plain script tag instead. You lose seamless login and coupon auto-apply, but the agent, the portal and reward codes all work - see Any website.