Skip to main content
A widget key is public — it sits in your page source. Anyone could copy the snippet onto their own site and chat with your agent on your bill. Allowed domains stop that. Set them under Allowed domains on Agents → your agent → Channels › Website chat › Install. A new widget has no list, which means it works anywhere.

​
How patterns match

  • example.com covers example.com, www.example.com and shop.example.com.
  • Add localhost while a developer is working on the site locally.

​
What happens to an unlisted site

Once a list exists, it is enforced in two places:
  • The widget’s config request answers 403 to a page on a domain nobody listed. The launcher may still draw in its default style, but it gets none of your saved settings.
  • The conversation frame is served with a Content-Security-Policy: frame-ancestors header naming your domains, so the browser refuses to show it inside any other page.
Save the list before you move the widget to a new domain, not after. On a page whose domain is not listed, the chat panel will not open.