Settings

Each AI agent has its own Security page: a per-visitor rate limit, a monthly credit cap, identity verification for logged-in visitors, and permanent actions.

Open your agent, then click Security in the sidebar →

Every AI agent has its own settings. Open an agent and choose Security (the gear icon) in the left sidebar. The page holds the guardrails that protect the agent from abuse and runaway credit spend, plus a set of permanent actions at the bottom.

Rate limit Starter and up

Cap how many messages a single visitor can send in a rolling minute. Visitors are counted per device, so this stops a flood from one browser burning through your credits.

• Messages per visitor per minute, the ceiling for one visitor.
• Set it to 0 for unlimited, which turns the rate limit off.

Monthly credit cap Starter and up

Set a ceiling on how many credits this agent can spend in the current monthly window. Once the cap is reached, the widget stops answering new messages until the period resets.

• Monthly credit cap for this AI agent, the spend ceiling for the current window.
• Set it to 0 for unlimited.

The Reset counter button next to the field starts a fresh monthly window for this agent. Past spend stays in your ledger but no longer counts toward the cap, and the reset is logged. Save any pending changes before you reset.

Identity verification

Let your backend prove who each logged-in visitor is. Once verified, the conversation is bound to that user's id: nobody can impersonate them from the browser, the inbox shows the real user behind each chat with a Verified badge, and the same person gets the same conversation thread on any device. Available on every plan.

Three steps:

1. Generate the secret. On the Security page, click Generate secret under Identity verification and store it in your backend. Treat it like a password: it must never appear in browser code.
2. Sign the user id on your server. When rendering a logged-in page, compute the HMAC of the user's id with the secret (hex-encoded):

   # Node.js
   const crypto = require("crypto")
   const userHash = crypto.createHmac("sha256", IDENTITY_SECRET).update(userId).digest("hex")
   
   # Python
   import hashlib, hmac
   user_hash = hmac.new(IDENTITY_SECRET.encode(), user_id.encode(), hashlib.sha256).hexdigest()
   
   # PHP
   $userHash = hash_hmac("sha256", $userId, $identitySecret);

3. Add both values to your embed tag. Copy the ready-made tag from the Security page; it is your normal embed tag plus two attributes your server fills in:

   <script src="https://agents.dante-ai.com/embed.js"
     data-agent-id="YOUR_AGENT_ID" data-widget-key="YOUR_WIDGET_KEY"
     data-user-id="USER_ID" data-user-hash="HASH_FROM_YOUR_SERVER"
     crossorigin="anonymous" async></script>

The optional Require verified identity switch limits the agent to verified visitors only: on logged-out pages the widget simply stays hidden. The switch activates once a secret exists.

Permanent actions

These sit at the bottom of the page under a Permanent action heading and are available on every plan. Each one asks you to confirm first.

Marketing emails

Marketing email is opt-in. The consent checkbox on the signup form is unticked by default. You receive product news and offers only if you tick it yourself, and if you do not tick it we take that as a no. Leaving it unticked has no effect on your account, your plan, or the emails we must send you about your subscription and security.

If you sign up with Google you do not pass that checkbox, so we ask you instead once you have finished setting up your agent. Until you answer, you are treated as not having opted in and we send you no marketing email. Answering either way is a real answer: we record what you chose and when you chose it, so a “no” is recorded as your decision rather than as silence.

You can change your mind at any time using the unsubscribe link at the foot of any marketing email. That applies only to marketing: transactional messages such as billing receipts, password resets and service notices are sent regardless, because they are part of running your account.

Cookies and tracking

On your first visit we show a small cookie banner with two choices, Decline and Accept all. It controls analytics only, never the parts of the site that have to work for you to sign in and use your agents.

• Accept all lets us record anonymous product analytics, which is how we see where people get stuck and what to fix next.
• Decline stops that recording. It stops our own analytics as well as Google's, and it stays stopped, ticking the Terms checkbox or signing in will not quietly undo it.

Your choice is remembered for a year and applies across every part of Dante AI you visit, so you only answer once. Once you are signed in the banner does not appear again.

Looking for account or workspace settings?

A few things you might expect here live elsewhere:

• Your name, password, two-factor authentication, workspace name, and account deletion are on the Profile & Settings page, reached from your account menu.
• Plans, credits, and invoices are covered in Billing and Understanding credits.
• Inviting teammates and roles are covered in Team management.
• Serving the widget from your own subdomain is covered in Custom domains.

Still stuck? We'll help.

Every plan, including Free, comes with human support. If something isn't behaving the way you expect after following the steps above, send us a note and we'll get back to you promptly.

Contact our team →