Allowed domains
Allowed domains restrict which origins may load your widget configuration and send messages. Requests from unlisted domains are blocked — preventing unauthorized sites from embedding your assistant.
Add domains
Section titled “Add domains”- Open Deployments → widget → Security → Allowed domains.
- Add each origin without path:
| Correct | Incorrect |
|---|---|
https://www.example.com | https://www.example.com/checkout |
https://staging.example.com | example.com (missing scheme) |
- Include every subdomain you use (
www,app, staging hosts). - Save and test from each domain.
Local development
Section titled “Local development”Add development origins explicitly:
| Origin | Use |
|---|---|
http://localhost:3000 | Local dev server |
http://127.0.0.1:5173 | Vite / Astro preview |
Remove or limit localhost entries before production cutover.
Behavior when blocked
Section titled “Behavior when blocked”| Symptom | Cause |
|---|---|
| Widget blank or config error | Current page origin not on list |
| Works on staging, fails on prod | Production domain not added |
See Domain not allowed troubleshooting.
JWT and domains
Section titled “JWT and domains”JWT verification is separate — domains control where the widget loads; JWT controls who the visitor is.