Domain not allowed

A 403 Forbidden on widget/config or widget/messages almost always means the browser’s Origin header does not match your deployment’s allowed domain list.

Confirm the error

Browser DevTools → Network → click the failed request:

Field	Blocked example
Status	`403`
URL	`https://api.chatevo.ai/api/v1/widget/config?deployment_id=…`
Request header	`Origin: https://shop.example.com`
Response body	`{ "error": { "code": "domain_not_allowed" } }`

Fix: add the origin

Deployments → Web widget → Security → Allowed domains.
Add the exact origin from the Origin header (scheme + host + port).
Save.
Hard-refresh the page (Cmd+Shift+R / Ctrl+Shift+R).

Your site URL	Allowlist entry
`https://www.example.com`	`https://www.example.com`
`https://example.com`	`https://example.com` (separate from `www`)
`https://app.example.com`	`https://*.example.com` or exact subdomain
`http://localhost:5173`	`http://localhost:5173` (staging only)

Wildcard patterns

https://*.example.com matches any single subdomain:

✅ https://app.example.com
✅ https://staging.example.com
❌ https://example.com (apex — add separately)
❌ https://deep.app.example.com (only one level)

Verify with cURL

curl -s -o /dev/null -w "%{http_code}" \
  "https://api.chatevo.ai/api/v1/widget/config?deployment_id=dep_YOUR_ID" \
  -H "Origin: https://www.yourbusiness.com"

Expect 200. Change the Origin value to match each domain you need.

Non-origin issues that look similar

Issue	Difference
Wrong deployment ID	`404` not `403`
Archived deployment	`404` or `deployment_inactive`
API key in widget call	Widget does not use API keys — remove `Authorization` header from custom code

Preview and staging environments

Each environment needs its own entry:

Environment	Typical origin
Vercel preview	`https://project-abc-team.vercel.app`
Netlify branch	`https://deploy-preview-42--site.netlify.app`
Staging	`https://staging.example.com`

Consider a separate staging deployment with relaxed localhost entries.