Allowed domains

Restrict where the widget can load by adding allowed domains in workspace settings. Our backend only allows the embeddable widget to load on domains you have added.

How it works

When someone visits a page with your widget:

1. The widget script loads and makes requests to our API (e.g. to fetch config, send messages).
2. We check Origin or Referer header.
3. If the domain is in your workspace's allowed embed domains list, the request succeeds.
4. If not, the request is rejected with a 403 error and the widget will not work.

Adding domains

1. Go to Workspace → Widget or Embed settings.
2. Add domains in the format example.com or https://example.com. Paths and query strings are not allowed—use only the hostname.
3. For multiple environments, add each: example.com, www.example.com, staging.example.com, etc.

Validation

• Each domain must be valid (e.g. example.com, https://example.com).
• Paths and query strings are not allowed.
• Domains are normalized (e.g. https://example.com/ becomes example.com).