API
The integration comes down to a single tag, to paste just before </body> on every
page of the website — not only the one holding the form.
<script src="https://api.example.com/api/script-019f0000-0000-7000-8000-00000000000a.js" defer></script>
The exact address is shown in the client's panel, on the website's page, in the Integration section. It uses the website's serving domain: the client's custom domain if one has been declared, the platform's domain otherwise.
GET /api/script-{website}.js
The website's integration script, customized with its configuration and the index of its forms — their identifier and CSS selector, not their fields: the script loads the forms it finds in the page separately — see How forms are loaded.
| Check | Value |
|---|---|
| Authentication | none — the resource is public |
| Origin | not checked: the tag is loaded by the visitor's browser |
| Rate limiting | none; caching absorbs the traffic |
Path parameters
| Name | Type | Purpose |
|---|---|---|
website |
UUID | Website identifier, as shown in the panel |
Response 200
Content-Type: text/javascript; charset=UTF-8
Cache-Control: public, max-age=3600, must-revalidate
ETag: "8f1c…"
Last-Modified: Tue, 15 Sep 2026 10:12:44 GMT
The body is the minified script. It defines window.WEBSITE, window.FORMS — filled as
the forms of the page are loaded — and window.VISITOR_HASH — see What the script publishes.
Response 304
A request carrying an If-None-Match equal to the current ETag receives a 304 with
no body. The fingerprint changes with the website, the list of its active forms (a form
linked, unlinked, disabled or renamed, a CSS selector changed), its captcha chain and the
script's code — not with the content of a form, which the script loads separately. Such
a change reaches browsers within an hour, and immediately on the first revalidated
request. The script's weight does not depend on the number of forms of the website.
Errors
| Code | When |
|---|---|
404 |
The UUID does not match any website |
403 |
The website is disabled |
What the script does once loaded
- It tracks the visit: page view, referrer, campaign if any. This is what later makes it possible to attribute a request to the campaign that produced it.
- It finds the forms of the page, loads them in one request, already translated, then builds the ones the client chose to have rendered by Rikochey, or attaches to the ones you marked in your own HTML. Forms added to the page later are loaded the same way — see How forms are loaded.
- It validates the fields, solves the captcha and submits the request.
On a page without a form, it only tracks the visit.
What it does not do
It writes no advertising cookie, loads no font or stylesheet, and injects nothing into your pages apart from the form you pointed it at.