Allowed domains

Your Organization ID is visible in your page source, so anyone could paste your snippet on another site and spend your AI replies. The allowed-domains list stops that: when it is set, the widget only starts a conversation on the sites you name.

Set the list

1. Open Widget Customization

   Scroll to Allowed Domains at the bottom of the page.

2. Add one domain per line

   For example:

   example.com
   shop.example.com
   

   Subdomains are included automatically, so example.com also allows www.example.com and app.example.com. You can paste a full address such as https://www.example.com/pricing; the scheme and path are stripped when saving. Up to 20 entries.

3. Save Settings

   The change applies to new conversations immediately.

How matching works

Ports are ignored, so localhost:3000 is covered by an entry of localhost while you develop. An empty list allows every site.

What a blocked visitor sees

On a page that is not on the list, the widget shows: "This website is not allowed to use this chat widget. The workspace owner can update the allowed domains in the widget settings." Nothing is sent to the agent and no AI reply is spent.

Good to know

• The check runs when a visitor's session is created. A visitor who already has a valid session from an allowed site keeps it for up to 24 hours.
• The page's origin is reported by the visitor's browser. The list raises the bar considerably against casual misuse, but treat it as a deterrent rather than an absolute guarantee.
• Add your builder's preview domain while you test a new site, and remove it afterwards.
• If you forget a domain, your own widget stops working there too. The troubleshooting page lists this as the second most common reason for a missing widget.