Documentation

Domain allowlist & security

Restrict where your widget is allowed to load, and understand how the widget is isolated.

By default the widget can load on any site. Add a domain allowlist in the widget settings to restrict it to your own domains.

• Leave the list empty to allow all websites.
• Add domains like example.com — subdomains are allowed automatically (e.g. shop.example.com).
• Requests from other origins are rejected by the server.

How the widget is isolated

The widget UI runs entirely inside a sandboxed iframe, so it can't read or interfere with your page — and your page's styles can't leak into it. Chat requests are rate-limited and origin-checked.