Customer Dashboard apps

A Customer Dashboard app is a page you host, such as an order lookup or a billing console, that opens as a tab beside a ticket's Messages in the Help Desk. Agents see your data next to the conversation without switching tools.

1. Register the app

In Settings, Help Desk, Customer Dashboard apps, add a name and the page address. You need Help Desk manage rights. The address must be public https. A workspace can register up to 10 apps, and each one shows as a tab on every ticket.

2. Read the context in your page

QuiQSol loads your page in a sandboxed frame and posts the context to it when it loads, again whenever the ticket changes, and whenever your page asks for it.

<script>
  const QUIQSOL = 'https://app.quiqsol.com';

  window.addEventListener('message', (event) => {
    if (event.origin !== QUIQSOL) return;          // only trust QuiQSol
    if (event.data?.event !== 'quiqsol.context') return;
    const { conversation, contact } = event.data;
    showCustomer(contact.email, contact.externalIds);
  });

  // Ask for the context at any time, for example after your own sign-in.
  window.parent.postMessage({ type: 'quiqsol:request-context' }, QUIQSOL);
</script>

What does the payload contain?

{
  "event": "quiqsol.context",
  "version": 1,
  "conversation": {
    "id": "6720c0ffee...",
    "number": "TICK-00042",
    "subject": "Order hasn't arrived",
    "status": "OPEN",
    "priority": "HIGH",
    "channel": "WHATSAPP",
    "tags": ["delivery"],
    "assignee": { "id": "66f1...", "name": "Riley Adeyemi" },
    "createdAt": "2026-11-03T09:12:44.000Z"
  },
  "contact": {
    "id": "66e9...",
    "firstName": "Ada",
    "lastName": "Obi",
    "name": "Ada Obi",
    "email": "ada@example.com",
    "phone": "+2348012345678",
    "company": "Obi Stores",
    "externalIds": { "shopify": "7340012", "emple": "EMP-1182" }
  }
}

contact is null when the ticket has no customer linked yet. externalIds holds the ids your integrations matched to this person, keyed by system.

What does QuiQSol never send?

No API key, session or sign-in token ever reaches your page. Your page authenticates its own users. If it needs QuiQSol data beyond the payload, call the REST API from your own server with a key you keep there.

How is it kept safe?

• Origin allow-list. QuiQSol posts only to the origin of the address you registered, and answers only messages from that same origin and frame. Always check event.origin on your side too.
• Sandboxed frame. The frame can run scripts, submit forms and open new tabs. It cannot navigate the QuiQSol window or reach its cookies or storage.
• https only. Addresses with credentials, local hosts or bare IP addresses are refused.

My page will not load in the tab

Your server must allow framing by QuiQSol. If it sends X-Frame-Options or a Content-Security-Policy with frame-ancestors, allow https://app.quiqsol.com. Agents can always use Open in a new tab above the frame.