Add an AI agent to your Rails app

Rather not do it by hand? Your coding agent can: see Verb for Claude Code or Cursor.

1. Add the script tag

Put it in app/views/layouts/application.html.erb, just before </body>, once. Your site key is in the dashboard.

<script src="https://api.askverb.com/v1/verb.js"
        data-verb-site="YOUR_SITE_KEY" defer></script>

If you send a Content-Security-Policy, it lives in config/initializers/content_security_policy.rb: add https://api.askverb.com to script_src and connect_src.

2. Mint a token on your server

Verb treats every visitor as anonymous until your server says who they are. Sign the logged-in user's id and a short expiry with the key from your dashboard. Both halves are base64url without padding: standard base64 is the one mistake that fails every token while looking right in a log.

# app/controllers/verb_controller.rb
# routes.rb: get "/api/verb-token", to: "verb#token"
require "openssl"
require "base64"

class VerbController < ApplicationController
  def token
    return head :unauthorized unless current_user

    claims = { sub: current_user.id.to_s, exp: Time.now.to_i + 900 }

    # padding: false is not optional. A trailing "=" fails the signature check.
    body = Base64.urlsafe_encode64(claims.to_json, padding: false)
    sig  = Base64.urlsafe_encode64(
      OpenSSL::HMAC.digest("SHA256", ENV.fetch("VERB_SIGNING_KEY"), body),
      padding: false
    )

    render json: { token: "#{body}.#{sig}" }
  end
end

3. Hand it to the widget

const getSessionToken = () =>
  fetch("/api/verb-token", { credentials: "same-origin", cache: "no-store" })
    .then(r => r.json())
    .then(({ token }) => token);

// Sign in now, and let the widget ask again when the token gets old.
window.Verb.configure({ getSessionToken });
getSessionToken().then(token => token && window.Verb.identify(token));

// And wherever your app signs somebody out:
// window.Verb.reset();

The widget asks for a fresh token before the old one expires, and clears the conversation when a different person signs in. The identity docs cover the details.

4. Describe what it may do, then test it

List the actions in a verb.md: each one says whether it reads or writes, and anything that writes asks the user for a yes with the real values first. Every site comes with a test site that only answers on localhost, so you try it against your development data before your users see it. Actions that need your app's own client go through an adapter.