Hi Trailblazers,
I’m looking for some architectural advice on integrating a third-party GenAI search widget into our Experience Cloud / B2B Commerce site.
The Setup: We have selected a third-party AI search tool that sits on our storefront to help users find case studies using natural language. For privacy and compliance reasons, we want this external AI to be completely "stateless."
The Goal: We want Salesforce to hold the "brain." Salesforce will retain the user’s history, past purchases (coursepacks), and role. When an authenticated user interacts with the AI widget (e.g., they ask, "Give me a refreshed version of my pack from last year"), we need Salesforce to dynamically pass that historical context (like past SKUs) to the AI widget at the exact moment of the query, without permanently storing PII on the third-party side.
My Questions:
- Passing the Payload: What is the best practice for injecting this dynamic user context into an external widget? Should we use a custom LWC to fetch the user’s history via Apex and pass it as a hidden payload/parameter to the widget's API? Or is it better to encode this context into a JWT?
- General Advice: Has anyone built a similar architecture where Salesforce acts as the memory engine for a stateless external AI? Any "gotchas" we should watch out for?
We are not looking to replace the tool with Agentforce at this time; we are strictly focused on the data integration layer between our chosen vendor and Salesforce.
Any insights, documentation, or recommended patterns would be hugely appreciated! Thanks!
Could you try using a custom LWC as a wrapper around the vendor widget? The LWC could intercept the user's query, call an Apex controller to retrieve the user's relevant context (such as role, purchase history, and past SKUs), and then pass that context to the AI service at request time.
If the vendor supports it, you could consider using a short-lived signed JWT to carry the context, as it provides tamper protection and expiration. Otherwise, a minimal JSON context payload sent over HTTPS is also a common and valid approach.
A few things I'd validate before implementing:
- Does the vendor's SDK/API support passing custom context (JWT, headers, or metadata)?
- Is Apex enforcing the correct sharing model for Experience Cloud users?
- Does the vendor guarantee that request payloads aren't retained or used for model training?
- Would routing requests through Salesforce or middleware make sense to keep API credentials server-side?
This approach keeps Salesforce as the system of record while allowing the external AI to remain stateless by receiving only the context needed for each request.
Hope this helps. Thanks!