A widget key is public — it sits in your page source. Anyone could copy the snippet onto their own site and chat with your agent on your bill. Allowed domains stop that.
Set them on the agent’s Install page. A new widget has no list, which means it works anywhere.
How patterns match
example.com covers example.com, www.example.com and shop.example.com.- Add
localhost while a developer is working on the site locally.
What happens to an unlisted site
Once a list exists, it is enforced in two places:
- The widget’s config request answers
403 to a page on a domain nobody listed. The launcher may still draw in its default style, but it gets none of your saved settings.
- The conversation frame is served with a
Content-Security-Policy: frame-ancestors header naming your domains, so the browser refuses to show it inside any other page.
Save the list before you move the widget to a new domain, not after. On a page whose domain is not listed, the chat panel will not open.
