Build with HeySale.

1. 1. Create your salesperson

   Enter the website address in HeySale. She reads the site and learns what it sells.

2. 2. Configure her

   Set her name, greeting, objective, appearance, language and allowed domains.

3. 3. Install HeySale

   Copy the embed snippet from your dashboard and place it globally on the site.

4. 4. Verify

   Load an authorized page and confirm she launches. Installation is detected automatically.

The embed carries a key unique to your salesperson, so there is no generic snippet to copy from this page. Get your embed code from your HeySale dashboard.

HeySale is a single asynchronous script tag placed once, globally, before the closing </body> tag. The same snippet works on plain HTML, React and other single-page apps, WordPress, Shopify, Google Tag Manager and custom CMS templates — there is nothing platform-specific to install.

• The script loads asynchronously and does not block page rendering.
• Loading a page does not start a conversation; conversational resources begin only when a visitor engages.
• Domain authorization is enforced: the salesperson only runs on domains you have authorized.
• Installation is detected automatically and shown in your dashboard.
• Because the tag is global, she can stay with a visitor across pages.
• Adding it through a tag manager works the same way as adding it to a template.

Building on Lovable? See the Lovable integration and the HTTP provisioning guide.

Give compatible AI assistants and coding agents the ability to create and install a HeySale AI Website Salesperson.

https://hey.sale/mcp

{
  "mcpServers": {
    "heysale": {
      "url": "https://hey.sale/mcp"
    }
  }
}

Available MCP tools

Every tool response carries a next_action, and creation is idempotent per website, so an assistant calling twice does not create two salespeople. Creation also returns a persistent salesperson_id and a claim link the website owner uses to take ownership in HeySale — an assistant never has to ask them for an API key.

Typical workflow

1. 1User intent
2. 2AI invokes create_website_salesperson — the response carries a persistent salesperson_id and a claim link
3. 3HeySale learns the website
4. 4AI checks salesperson status
5. 5AI retrieves the installation script
6. 6AI adds HeySale to the website
7. 7AI verifies the installation from HeySale telemetry
8. 8AI hands the claim link to the website owner
9. 9The website starts having sales conversations

Full server reference: /developers/mcp.

The public HeySale MCP repository contains public integration metadata, documentation and examples for HeySale’s hosted MCP service. It does not make the HeySale hosted application or backend open source — those remain proprietary. The repository’s LICENSE and NOTICE files are the authority.

Repository

heysale/heysale-mcp

License

Apache 2.0

MCP Registry identity

io.github.heysale/heysale

A small REST surface covers the same ground as the MCP tools, plus lead export. All responses are JSON. Provisioning endpoints are public; anything that reads a salesperson’s private data requires that salesperson’s API key, created in the dashboard under Developer.

Authentication

Keys look like hs_live_…, are shown once, are stored only as a hash, and are scoped to a single salesperson. Send them as Authorization: Bearer YOUR_API_KEY or X-Api-Key: YOUR_API_KEY. Revoke a key in the dashboard at any time.

curl -X POST https://hey.sale/api/public/v1/integrations/salespeople \
  -H "content-type: application/json" \
  -H "idempotency-key: your-unique-key" \
  -d '{"website_url":"https://example.com","integration_source":"api"}'

curl https://hey.sale/api/public/v1/leads?limit=25 \
  -H "authorization: Bearer YOUR_API_KEY"

Common errors

Failures return { ok: false, error: { code, message }, next_action }. Reasonable rate limits apply to protect service availability; salesperson creation is limited per origin. Visitor conversation traffic is protected separately from authenticated developer traffic.

Need something the endpoints above do not cover? hello@hey.sale.

Add endpoints in the dashboard under Developer, choose the events each one receives, and send a test delivery. Every delivery attempt is logged with its response status.

• lead.captured

  A new lead was created from a conversation or a form.

• lead.updated

  HeySale learned something material later — company, title, needs, qualification.

• conversation.ended

  A conversation finished, with its summary and duration.

{
  "event": "lead.captured",
  "sent_at": "2026-01-01T12:00:00.000Z",
  "data": { "id": "…", "name": "…", "email": "…", "company": "…" }
}

import { createHmac, timingSafeEqual } from "crypto";

const timestamp = req.headers["x-heysale-timestamp"];
const signature = req.headers["x-heysale-signature"]; // "v1=<hex>"
const expected =
  "v1=" + createHmac("sha256", YOUR_WEBHOOK_SECRET)
    .update(`${timestamp}.${rawBody}`)
    .digest("hex");

const ok =
  signature.length === expected.length &&
  timingSafeEqual(Buffer.from(signature), Buffer.from(expected));

Deliveries are POSTed as JSON with x-heysale-event, x-heysale-timestamp and x-heysale-signature (v1= plus an HMAC-SHA256 of timestamp.body using your endpoint secret). Requests time out after 10 seconds. Failed deliveries are recorded and surfaced in the dashboard, and HeySale does not currently retry them automatically — treat your endpoint as needing to accept quickly, and re-fetch from the leads API if you miss an event.

You do not need to write code, and you can ignore everything above about MCP and APIs. Adding HeySale means pasting one snippet into whichever place your site loads global scripts:

• A CMS theme header or footer template.
• Google Tag Manager, as a custom HTML tag firing on all pages.
• A website builder's “custom code” or “scripts” area.
• A short handoff to your developer: “please add this script sitewide, before the closing body tag”.

After that, load the site and confirm she appears. Your dashboard shows the installation as detected.

• Everything is served over HTTPS.
• Account data is isolated at the row level, so one account cannot read another's.
• The embed only runs on domains you have authorized.
• API keys and webhook secrets are stored hashed or secret-side, and shown once.
• Team actions are recorded in an audit log.
• Payment details are handled by our payment provider; HeySale never stores card numbers.

If you implement HeySale on a site you operate, make sure your own privacy notices describe your use of conversational AI and any visitor information collected, as applicable law requires. This is information, not legal advice.

Need help implementing HeySale? Email our team at hello@hey.sale. For security vulnerabilities, use the disclosure contact on the security page rather than a public GitHub issue.