Schedule booking in chat — 2-minute setup

If your bot — especially the Sales persona — has previously asked in loops about day and time ("Tuesday or Thursday? What time suits you on Tuesday?"), this function solves the problem structurally: the bot recognizes the booking request and sends a calendar card with your Calendly/cal.com link. The visitor clicks, selects a slot themselves, and the appointment automatically lands in your calendar.

Setup

Step 1: Create Booking URL (externally, one-time)

Create a public booking URL with your provider. Functioning free-tier options:

• Calendly — easiest setup, one event type is sufficient
• cal.com — open-source alternative, more generous free tier
• TidyCal — 1 event type for free
• SavvyCal / Acuity Scheduling — commercial but proven

Step 2: Enter URL in SilentChat

In the dashboard: Settings → AI Bot → Handoff & Appointments.

In the "Appointment Booking" section:

• Booking URL — the HTTPS link (https://calendly.com/company/30min)
• Card Title (optional) — the button text on the card. Leave empty = "Book Appointment"
• Toggle "Enable Booking Card" — activates the function

Allowed Hosts: calendly.com, cal.com, savvycal.com, tidycal.com, acuityscheduling.com. Other hosts are rejected with ERR_BOOKING_URL_HOST — as protection against phishing via the bot channel.

Step 3: Recommend Sales Persona (optional but useful)

The included Sales persona is already tuned to use the marker as soon as the visitor mentions an appointment. Other personas also work — the marker is in the general system prompt and is persona-independent.

How It Works Technically

1. As soon as the visitor wants an appointment (even paraphrased or in another language), the bot recognizes the intent.
2. The bot writes a short confirmation sentence ("Got it, here is my calendar — choose a slot that suits you:") followed by the internal marker [BOOKING].
3. The backend strips out the marker, persists the confirmation sentence, and automatically appends a booking_card message with your calendar link.
4. The visitor sees the card, clicks, books in the new tab → the slot lands in your calendar.

The visitor never sees the marker. They only see the confirmation + the card.

Fallback Behavior

• URL empty / Toggle off: The marker is not mentioned in the prompt, the bot asks politely (or suggests a handoff if handoff is active). No loop risk — the Sales persona has an anti-loop rule that explicitly protects against multiple questions.
• URL host removed from the allow list (Super Admin intervention): The bot sends a text fallback "You can reach us directly — write us your preferred time and we will contact you" instead of a broken card.
• Handoff + Booking active in parallel: Both markers are monitored in parallel. Whichever appears first in the stream wins. In case of a tie, handoff wins (escalation is the safer default).

Security

• Host Allow List: Only the five mentioned providers. Extension requires code change + review.
• HTTPS Requirement: HTTP URLs are rejected with ERR_BOOKING_URL_SCHEME.
• Tenant Isolation: The URL is tenant-scoped. Other tenants do not see it.
• URL Length: Truncated at 500 characters.
• No XSS: The card renders Title + URL as plain text, the button target is the validated URL.

GDPR

The card itself does not collect any data — it is a link. Once the visitor clicks, they land on the provider's page and are subject to its privacy conditions. We recommend mentioning the provider used in your own privacy policy (Calendly → USA, cal.com → EU self-hosted possible, etc.).

Provider Comparison (as of 2026-05)

For GDPR-compliant setups: cal.com self-hosted is the only truly EU-compliant option without a commercial license.

What You Don't Have in v1

• Multi-URL per Persona (e.g., demo URL vs support call URL): Coming in v2 if tenant demand is there.
• Booking Tracking (see if the visitor actually booked): Requires provider-specific webhooks. In v1, you see this in the provider dashboard.
• Embedded Booking Widget: The card opens the link in a new tab instead of directly embedding the Calendly iframe. This is intentional — iframe embeds often break at CSP headers in customer sites.