diff --git a/server.js b/server.js
index ff3999c..90917b3 100755
--- a/server.js
+++ b/server.js
@@ -33,22 +33,7 @@ app.get('/free-access/:shop', (req, res) => {
 });
 
 // ── PUBLIC CHAT ENDPOINTS (for customer widget) ──────────────────────────────
-app.post('/chat/:shop', (req, res) => {
-  const shop = decodeURIComponent(req.params.shop || '').toLowerCase().trim();
-  const { text, visitorId } = req.body;
-  if (!shop || !text) return res.status(400).json({ error: 'shop and text required' });
-  const msg = addChatMessage(shop, 'customer', String(text).slice(0, 1000), visitorId || null);
-  res.json({ ok: true, message: msg });
-});
-
-app.get('/chat/:shop', (req, res) => {
-  const shop = decodeURIComponent(req.params.shop || '').toLowerCase().trim();
-  if (!shop) return res.status(400).json({ error: 'shop required' });
-  const chat = readChat(shop);
-  res.json({ messages: chat.messages || [] });
-});
-
-// Embeddable widget script  ─  <script src="https://backend.data4autos.com/chat/widget.js?shop=SHOP"></script>
+// widget.js MUST be before /chat/:shop — otherwise Express treats "widget.js" as the :shop param
 app.get('/chat/widget.js', (req, res) => {
   const shop = (req.query.shop || '').toLowerCase().trim();
   const backendUrl = 'https://backend.data4autos.com';
@@ -205,7 +190,23 @@ app.use('/', auth);
 app.use(express.json({ limit: '10mb' }));
 app.use(express.urlencoded({ limit: '10mb', extended: true }));
 
-// 4) Your other endpoints
+// 4) Chat message endpoints (need body parser — must be after it)
+app.post('/chat/:shop', (req, res) => {
+  const shop = decodeURIComponent(req.params.shop || '').toLowerCase().trim();
+  const { text, visitorId } = req.body;
+  if (!shop || !text) return res.status(400).json({ error: 'shop and text required' });
+  const msg = addChatMessage(shop, 'customer', String(text).slice(0, 1000), visitorId || null);
+  res.json({ ok: true, message: msg });
+});
+
+app.get('/chat/:shop', (req, res) => {
+  const shop = decodeURIComponent(req.params.shop || '').toLowerCase().trim();
+  if (!shop) return res.status(400).json({ error: 'shop required' });
+  const chat = readChat(shop);
+  res.json({ messages: chat.messages || [] });
+});
+
+// 5) Your other endpoints
 app.post('/fulfillment', (req, res) => {
   console.log('POST /fulfillment:', req.body);
   res.sendStatus(200);