Mamtack

Embeddable website commenting tool — pin feedback to any page, collaborate in real time.

Table of Contents

• Quick Start
• Installation
• Features
• Configuration
• Security & Self-Hosting

Quick Start

1. Register at mamtack.com to get your API key
2. Add this before </body>:

<script src="https://unpkg.com/@mamtack/[email protected]/dist/mamtack.iife.js"
        data-project="your-site-name"
        data-key="YOUR_API_KEY"></script>

3. Mobile support — make sure your page includes a viewport meta tag:

<meta name="viewport" content="width=device-width, initial-scale=1">

That's it — open the page and start commenting.

Local-only mode: Omit data-key to run without a server — comments are saved in the browser's localStorage only. Add data-storage="local" to suppress the registration banner.

Installation

npm

npm install @mamtack/widget

The package ships two bundles in dist/:

| File | Format | Use case | |------|--------|----------| | mamtack.iife.js | IIFE (self-executing) | <script> tag embedding | | mamtack.es.js | ES module | Bundler import |

CDN (unpkg)

<script src="https://unpkg.com/@mamtack/[email protected]/dist/mamtack.iife.js"
        data-project="my-site"
        data-key="YOUR_API_KEY"></script>

Pin to a specific version (recommended for production) or use @latest for development.

Features

• Pin comments to any element on any webpage
• Threaded conversations with @mentions
• Real-time sync via Supabase
• Owner-only resolution
• Keyboard shortcut (C) for quick commenting
• Shadow DOM isolation — zero conflicts with host page
• Works on static sites, WordPress, prototypes, anything in a browser

Configuration

All configuration is done via data-* attributes on the <script> tag:

| Attribute | Required | Description | |-----------|----------|-------------| | data-project | Yes | Your site name (from the dashboard) | | data-key | No | API key for cloud sync. Omit for local-only mode | | data-storage | No | Set to "local" for localStorage-only mode (no network) | | data-app-base | No | Override the base URL used for Mamtack assets (auth callback pages). Normally auto-detected from the script src. Use this when your setup prevents auto-detection, e.g. behind a reverse proxy or bundled locally. Example: data-app-base="https://unpkg.com/@mamtack/[email protected]/dist" |

Security & Self-Hosting

See docs/SECURITY.md for:

• What data Mamtack accesses (and what it doesn't)
• Content Security Policy (CSP) configuration
• Subresource Integrity (SRI) verification
• Deployment options (local-only or Mamtack cloud)
• Version policy and minimum supported versions