Allowed domains
Decide which websites may show your agent, so that nobody else can embed it and spend your credits.
Your snippet is public: anyone who views your page's source can copy it. Allowed domains decides where it works.
Warning. While the list is empty, any website can embed your agent and use your credits. The Deploy page says so until you add a domain. Do this before you go live.
Setting it up
On Deploy, under Allowed domains, add every site where the widget should work and save.
- Type
example.comorhttps://example.com. A path is ignored:https://example.com/contactis stored ashttps://example.com. - You can list up to 50 sites per agent.
- A change takes effect within about 30 seconds.
What an entry matches
An entry means exactly that address and no other, unless it begins with *..
| You list | Works on | Does not work on |
|---|---|---|
https://example.com | https://example.com | https://www.example.com, https://shop.example.com, http://example.com |
*.example.com | https://www.example.com, https://shop.example.com, https://nl.shop.example.com | https://example.com, http://shop.example.com |
So list what you really use. For most sites that is two entries, with and without www. A name typed without https:// is stored as https://, which means a site that still runs on plain http:// has to be entered with http:// in front.
A *. in front stands for every subdomain, however deep, and not for the domain itself, which you list apart. It only goes in front of a domain somebody owns. *.com and *.co.uk are refused, and so are endings where anybody can have a site, such as *.vercel.app or *.github.io: they would let every site there embed your agent.
For a staging site or a local test, add those addresses too, for example http://localhost:3000, and remove them afterwards.
What it blocks
Once at least one domain is listed:
- Browsers refuse to show the chat inside any page that is not on the list.
- Questions from other sites are refused, as are ratings, bookings and the conversation history.
- Opening the chat's own address directly in a browser tab no longer works. That is intended. Use Show preview on the Deploy page, which always works.
What it does not do: it is not a password. The list is enforced by browsers, which is exactly what stops another website from embedding your agent in front of its visitors. A program that is not a browser can pretend to come from anywhere. Against that, the message limit per visitor and your plan's credit ceiling are the protection.
With your own domain
On a domain of your own, the snippet's address is yours, and your hostname only ever serves your own agents. Allowed domains still decides which client sites may embed each agent. For an agency that is the client's site, one list per agent.
The API is separate
Allowed domains governs the widget. Access through the API is governed by API keys and has nothing to do with this list.