Website widget
Allowed domains
Restrict which sites may embed your bot, and which origins may call the API.
A widget snippet is public by definition: it sits in your page source, and anyone can read it. Allowed domains are what stop that from mattering.
Set them before you launch
Configure the origins permitted to embed each bot. A request from anywhere else is refused.
Without this, someone can copy your snippet onto their own site and run your bot against your usage.
Two different lists
| List | Controls |
|---|---|
| Allowed domains | Which sites may embed and use a given bot |
| CORS origins | Which origins the API accepts browser requests from |
They are related but not the same. A staging site usually needs adding to both.
Wildcards are a decision, not a default
Allowing every subdomain is convenient and means any subdomain takeover also takes your bot. List the hosts you actually serve from.