Skip to content

Allowed domains

Allowed domains restrict which origins may load your widget configuration and send messages. Requests from unlisted domains are blocked — preventing unauthorized sites from embedding your assistant.

  1. Open Deployments → widget → SecurityAllowed domains.
  2. Add each origin without path:
CorrectIncorrect
https://www.example.comhttps://www.example.com/checkout
https://staging.example.comexample.com (missing scheme)
  1. Include every subdomain you use (www, app, staging hosts).
  2. Save and test from each domain.

Add development origins explicitly:

OriginUse
http://localhost:3000Local dev server
http://127.0.0.1:5173Vite / Astro preview

Remove or limit localhost entries before production cutover.

SymptomCause
Widget blank or config errorCurrent page origin not on list
Works on staging, fails on prodProduction domain not added

See Domain not allowed troubleshooting.

JWT verification is separate — domains control where the widget loads; JWT controls who the visitor is.