Embed: Integrate the PBX into Your Software

If you have a CRM, technical service program, or any web application, you can open PBX screens and web phone within your own interface. Live calls, call recordings, voice recordings, breaks, auto-dialing, number blocking, and browser phone can be embedded this way.

No PHP required. Works with plain HTML, jQuery, React, or any framework. Screens only open on the domain names you specify.

Base address: https://api.buluthat.com

1. Create embed code

In the panel Subscription Transactions > Embed Codes (CRM) open the page. If you are a reseller, do this in Reseller Panel > Embed and API you do this by selecting the customer from the page.

Your embed code wk_ starts with. This code is not secret; it is visible in the source of your page. It comes from the list of allowed domain names and the entry methods below.

2. Paste the code into your page

Single line

<div id="santral" style="height:720px"></div>
<script src="https://api.buluthat.com/assets/js/embed.js" data-key="wk_..." data-page="live_monitor" data-target="#santral"></script>

jQuery

<script src="https://api.buluthat.com/assets/js/embed.js"></script>
<script>
  $(function () {
    var santral = $('#santral').buluthat({ key: 'wk_...', page: 'report_calls' }).data('buluthat');
  });
</script>

Plain iframe

<iframe src="https://api.buluthat.com/embed.php?w=wk_...&page=live_monitor"
        style="width:100%;height:720px;border:0" allow="microphone; autoplay"></iframe>

In iframe for WebPhone allow="microphone" is required. embed.js he/she will add this himself/herself.

3. Screens

4. Authentication

a) Login in iframe

This is the default method. The user enters their email and password into the frame on the first launch; if two-step verification is enabled, a code is also requested. The session is only valid for this embed code and selected screens.

Some browsers (especially Safari) completely block cookies from other sites in frames. In this case, on the login screen Open in a new window remove the link. Use a signed link for a permanent solution.

b) Signed link from server (recommended)

Your CRM user is already logged into your system. Your server is from Buluthat for that user 2 minutes valid, one-time receives a login link and iframe's src gives the value. The user does not enter a password.

Key: In the customer account API Keys from the page Embed generate a comprehensive key. If you are a reseller, go to Reseller Panel > Embedding and API > Dealer API key use; this key is valid for all customers connected to you. The key only resides on your server, it does not go to the browser.

curl -X POST 'https://api.buluthat.com/api/embed.php?action=session' \
  -H 'Authorization: Bearer bt_...' \
  -H 'Content-Type: application/json' \
  -d '{"widget":"wk_...","user_email":"temsilci@firma.com","extension":"1000","page":"webphone"}'

The same request is made with the dealer key:

curl -X POST 'https://api.buluthat.com/api/embed.php?action=session' \
  -H 'X-Bt-Partner-Key: bp_...' -H 'Content-Type: application/json' \
  -d '{"tenant_id":123,"user_email":"temsilci@musteri.com","page":"live_monitor"}'

If no user is provided, the user without login in the embed code is used, and if that is not available, the customer representative is used.

Response:

{ "ok": true, "url": "https://api.buluthat.com/embed.php?w=wk_...&sso=...", "expires_in": 120, "user": "temsilci@firma.com" }

PHP example:

$ch = curl_init('https://api.buluthat.com/api/embed.php?action=session');
curl_setopt_array($ch, [
    CURLOPT_POST => true,
    CURLOPT_RETURNTRANSFER => true,
    CURLOPT_HTTPHEADER => ['Authorization: Bearer ' . getenv('BULUTHAT_KEY'), 'Content-Type: application/json'],
    CURLOPT_POSTFIELDS => json_encode(['widget' => 'wk_...', 'user_email' => $kullanici['email'], 'page' => 'live_monitor']),
]);
$cevap = json_decode(curl_exec($ch), true);
echo '<iframe src="' . htmlspecialchars($cevap['url']) . '" style="width:100%;height:720px;border:0" allow="microphone"></iframe>';

Other endpoints:

• GET ?action=widgets: lists embed codes. With dealer key tenant_id is required.
• GET ?action=ping: tests the key.

c) Login-less mode

The embed code opens without a password as the selected user. There are two conditions for this:

• The request must come from the frame of your allowed domain name.
• If you wish, it can also be required to come from your IP list.

Warning: wk_ this mode is low security because the code remains in the page source. Only for screens in your internal network, a restricted authorization staff use with your account.

5. JavaScript API and events

var s = Buluthat.mount('#tel', { key: 'wk_...', page: 'webphone' });

s.dial('05321234567');           // web telefonundan ara
Buluthat.dial('05321234567');    // sayfadaki ilk web telefonundan ara
s.go('report_calls');            // ekran değiştir

s.on('call', function (c) {
  // c.state: idle | ringing | dialing | incall ; c.number: karşı numara
  if (c.state === 'ringing') { musteriKartiniAc(c.number); }
});
s.on('ready', function (d) { /* ekran yüklendi: d.page */ });
s.on('resize', function (d) { /* içerik yüksekliği: d.height */ });

mount options:

Click-to-call example (jQuery):

$('.musteri-telefon').on('click', function () { Buluthat.dial($(this).text()); });

Messages are only accepted from the address of the Buluthat server. Buluthat only listens to commands coming from your authorized domains.

6. Security notes

• The embed session is stored in a separate cookie and only opens the selected screens. Subscription, payment, password, and API key screens will never be embedded.
• Each login and embed code change is for the customer Transaction History'to be written.'
• Deleting or closing an embed code instantly closes the screen on all pages using it.
• Do not place your API key in browser code, mobile app, or public repository. Details: API Security.