inkeep · sarah-inkeep · Mar 30, 2026 · Mar 30, 2026 · Mar 30, 2026 · Mar 30, 2026
diff --git a/agents-docs/content/talk-to-your-agents/(chat-components)/app-credentials.mdx b/agents-docs/content/talk-to-your-agents/(chat-components)/app-credentials.mdx
@@ -75,7 +75,48 @@ In addition to anonymous sessions, apps can be configured for **authenticated ch
     ```
   </Step>
   <Step>
-    **Widget sends the signed JWT** — the chat widget includes the JWT as a `Bearer` token instead of requesting an anonymous session.
+    **Widget sends the signed JWT** — pass a `getAuthToken` function in `baseSettings` that fetches a token from your backend route. The widget calls it automatically and includes the JWT as a `Bearer` token instead of requesting an anonymous session.
+
+    <CodeGroup>
+    ```typescript title="React"
+    import { InkeepEmbeddedChat, type InkeepBaseSettings, type InkeepAiChatSettings } from '@inkeep/agents-ui-cloud';
+
+    async function getAuthToken(): Promise<string> {
+      const res = await fetch('/api/inkeep-token', { method: 'POST' });
+      if (!res.ok) throw new Error('Failed to get auth token');
+      const { token } = await res.json();
+      return token;
+    }
+
+    export function AuthenticatedChat() {
+      const aiChatSettings: InkeepAiChatSettings = {
+        appId: 'YOUR_APP_ID',
+      };
+      const baseSettings: InkeepBaseSettings = {
+        getAuthToken,
+      };
+
+      return <InkeepEmbeddedChat baseSettings={baseSettings} aiChatSettings={aiChatSettings} />;
+    }
+    ```
+    ```javascript title="JavaScript"
+    async function getAuthToken() {
+      const res = await fetch('/api/inkeep-token', { method: 'POST' });
+      if (!res.ok) throw new Error('Failed to get auth token');
+      const { token } = await res.json();
+      return token;
+    }
+
+    Inkeep.EmbeddedChat('#chat-target', {
+      baseSettings: {
+        getAuthToken,
+      },
+      aiChatSettings: {
+        appId: 'YOUR_APP_ID',
+      },
+    });
+    ```
+    </CodeGroup>
   </Step>
   <Step>
     **Inkeep verifies the signature** — the server matches the `kid` header to a stored public key, verifies the signature, and extracts the user identity from the `sub` claim.

diff --git a/agents-docs/package.json b/agents-docs/package.json
@@ -26,7 +26,7 @@
   "dependencies": {
     "@inkeep/agents-cli": "workspace:*",
     "@inkeep/agents-core": "workspace:*",
-    "@inkeep/agents-ui": "^0.15.18",
+    "@inkeep/agents-ui": "^0.15.23",
     "@inkeep/agents-ui-cloud": "^0.15.18",
     "@inkeep/cxkit-react": "^0.5.98",
     "@inkeep/docskit": "^0.0.8",

diff --git a/agents-manage-ui/package.json b/agents-manage-ui/package.json
@@ -53,7 +53,7 @@
     "@better-auth/sso": "catalog:",
     "@hookform/resolvers": "^5.2.1",
     "@inkeep/agents-core": "workspace:^",
-    "@inkeep/agents-ui": "^0.15.21",
+    "@inkeep/agents-ui": "^0.15.23",
     "@nangohq/frontend": "^0.69.41",
     "@nangohq/node": "^0.69.41",
     "@nangohq/types": "^0.69.41",

diff --git a/agents-ui-demo/package.json b/agents-ui-demo/package.json
@@ -15,7 +15,7 @@
     "test": "echo 'No tests configured for chat-widget'"
   },
   "dependencies": {
-    "@inkeep/agents-ui": "^0.15.18",
+    "@inkeep/agents-ui": "^0.15.23",
     "lucide-react": "^0.539.0",
     "react": "^19.1.1",
     "react-dom": "^19.1.1"