Verb for Django
Add an AI agent to your Django app
Quick answer
Paste Verb's script tag into the base template every page extends, just before </body>, add a view that signs request.user's id with hmac and urlsafe base64 without padding, and hand the token to the widget. The agent then carries out your users' requests through your app's own endpoints as them, asking before it changes anything.
Rather not do it by hand? Your coding agent can: see Verb for Claude Code or Cursor.
1. Add the script tag
Put it in the base template every page extends (often templates/base.html), just before </body>, once. Your site key is in the dashboard.
<script src="https://api.askverb.com/v1/verb.js"
data-verb-site="YOUR_SITE_KEY" defer></script>If you send a Content-Security-Policy, often through django-csp in settings.py, add https://api.askverb.com to the script-src and connect-src lists.
2. Mint a token on your server
Verb treats every visitor as anonymous until your server says who they are. Sign the logged-in user's id and a short expiry with the key from your dashboard. Both halves are base64url without padding: standard base64 is the one mistake that fails every token while looking right in a log.
# views.py
# urls.py: path("api/verb-token", views.verb_token)
import base64, hashlib, hmac, json, os, time
from django.http import JsonResponse
def verb_token(request):
if not request.user.is_authenticated:
return JsonResponse({"error": "unauthorized"}, status=401)
claims = {"sub": str(request.user.id), "exp": int(time.time()) + 900}
# urlsafe_b64encode plus rstrip(b"="): the "=" fails the signature check.
body = base64.urlsafe_b64encode(json.dumps(claims).encode()).rstrip(b"=")
sig = base64.urlsafe_b64encode(
hmac.new(os.environ["VERB_SIGNING_KEY"].encode(), body, hashlib.sha256).digest()
).rstrip(b"=")
return JsonResponse({"token": f"{body.decode()}.{sig.decode()}"})3. Hand it to the widget
const getSessionToken = () =>
fetch("/api/verb-token", { credentials: "same-origin", cache: "no-store" })
.then(r => r.json())
.then(({ token }) => token);
// Sign in now, and let the widget ask again when the token gets old.
window.Verb.configure({ getSessionToken });
getSessionToken().then(token => token && window.Verb.identify(token));
// And wherever your app signs somebody out:
// window.Verb.reset();The widget asks for a fresh token before the old one expires, and clears the conversation when a different person signs in. The identity docs cover the details.
4. Describe what it may do, then test it
List the actions in a verb.md: each one says whether it reads or writes, and anything that writes asks the user for a yes with the real values first. Every site comes with a test site that only answers on localhost, so you try it against your development data before your users see it. Actions that need your app's own client go through an adapter.
Frequently asked questions
Will Django's CSRF protection block the agent's actions?
Reads are unaffected. For changes that go to CSRF-protected routes, mark those actions run: adapter, so they go through the same JavaScript your pages already use, which sends the X-CSRFToken header. A plain browser action does not add it, and Django would refuse the request.
Do I need to change my Django backend to add Verb?
Only one small endpoint that signs who is logged in. Everything the agent does goes through the API your app already has, as the signed-in user, so your existing routes, permissions and validation stay exactly as they are.
What happens if I skip the token step?
Reading works and every change is refused, because Verb treats every visitor as anonymous until your server says who they are. Users see an honest "you need to sign in" even though they are, which is the sign the token step is missing.