One Line of Code. A Direct Line to Your Team.
Enterprise-grade voice calling, embedded in any webpage with a single script tag. Any visitor calls your support team directly from their browser — no phone dialler, no app download, no friction.
Line of code to embed the widget
Single-use, IP-bound session token
GCM encryption on SIP credentials
Every SIP Credential Stays on Your Server
The Wemacx Call Widget lets any website visitor initiate a voice call to your support team directly from the browser — no phone dialler, no app download, no friction. One line of code in your HTML is all it takes. SIP credentials never leave your server. Every session runs on a single-use, IP-bound, five-minute token that is generated server-side and cannot be replayed.
AES-256-GCM Encryption
SIP credentials are encrypted with AES-256-GCM before database storage and decrypted only server-side at call time. The public API key in your HTML has zero access to credentials.
Single-Use Session Tokens
Every call runs on a 5-minute, IP-bound token generated fresh for each session. Each token can only be redeemed once — replay attacks are structurally prevented.
Subdomain Support
Add domain.org to cover all subdomains, or lab.domain.org to restrict to a specific subdomain only. Domain matching is enforced server-side on every token request.
Daily Call Limits
Per-API-key daily call limits enforced atomically in MySQL. Limits cannot be bypassed or incremented from the client side — all enforcement is server-side.
Built-In Domain Tester
Admin panel includes a live domain test tool — diagnose authorisation issues, test domain matching, and verify token generation without a real call.
Lead Capture
Optional pre-call form collects visitor details before the call connects. Data is logged to the database and passed as SIP headers to the receiving agent.
A Fully Multi-Tenant Application
Call Widget runs on Wemacx's secure multi-tenant platform. Each client's API keys, domain lists, and daily call limits are enforced within its own isolated tenant.