Two update functions, separated by what they change:
updateSidenetConfig(options)— SDK behaviour and chrome. Accepts every init option exceptcopilotId(see below), the callbacks (onOpen/onClose/onResize/onReady), and the one-shot init-only fields (customCSS,customStyles,sdkUi,defaultOpen). Concretely:auth,width,height,position,layout,offset,zIndex,theme('light' | 'dark'),agentId,agentVersionId,showAgentDropdown,keyboardShortcut,threadId,read_only,use_routing,groupName,groupId,firstMessage,context,variables,lastThread,debug,showClose,closeOnOutsideClick. Threenullsentinels:keyboardShortcut: nulldisables the shortcut,threadId: nullclears the pinned thread,agentVersionId: nullclears the pinned agent version.updateSidenetStyledConfig(styleConfig)— visual content. AcceptsPartial<SidebarSDKConfig>— the same shape the backend returns assdk_ui. Use it to overridetext(greeting / placeholder / suggestions) andthemedesign tokens. Partial calls merge into the current config, so passing onlytext.suggestionskeepstext.greetingand the loadedthemeintact.getRuntimeConfig()— synchronous read of the current merged{ text, theme }. Useful for snapshotting the resolved config (defaults + backendsdk_ui+ your overrides) without subscribing viauseSidebarConfig.
context and variables are updatable here too — each call replaces the whole value rather than merging into it, and applies to the next send. See Prompt Variables for both.
copilotId is init-only
It binds the whole session to a set of backend resources — the thread list, the agent list, the copilot’s sdk_ui config, and the id of every thread created since init. Swapping it in place would leave all of that pointing at the previous copilot, so updateSidenetConfig() ignores a changed value and warns:
Re-passing the current value is a silent no-op, so handing the SDK your whole config object on every update is safe — only an actual change warns.
Swapping the session
Everything else about identity — who the user is, which billing group they belong to, which tool credentials their tools use — lives in the session token. So none of it needs a teardown. Mint a new session and pass it as a unit:You rarely need this for expiry alone. While a
refresh_token is present the SDK refreshes on its own. Reach for this when you mint a different session — a new user, or updated tool credentials — or after a fatal onError.