Allowed origins control which website origins are trusted to initialize an Agent's public Chat widget.
This is an important deployment boundary because the widget JavaScript itself is public, while the Agent should run only from websites you authorize.
The interface explains that the public widget script should be restricted to trusted domains and that every origin must include its scheme and host.
Enter one origin per line. Examples:
https://example.comhttps://app.example.comInclude the protocol, such as https://. Do not enter only a bare domain when the form expects an origin.
Allowed Origin matching is strict. Subdomains are not automatically inferred.
For example:
https://example.com allows that exact origin.https://app.example.com.If both origins should run the widget, enter both separately.
Place each trusted origin on a separate line. This is useful when the same Agent runs on a main website and one or more approved subdomains.
After entering the trusted origins, select Save origins.
The Settings page displays a saved indicator after a successful update and reports how many origins are currently configured.
Before installing the Chat widget on real customer traffic, confirm that every intended production origin is listed and that unintended domains are not included.
A broad or incorrect origin policy can undermine the purpose of the restriction.
If testing from a separate development host or localhost origin, that origin must be authorized according to the same origin rules. Remove temporary development access when it is no longer required.
Allowed Origins answer the question: Which website origin may run this Agent?
Restricted Paths answer a different question: Which paths inside an already allowed origin should not display the widget?
If the widget is installed but fails to initialize, compare the browser's actual origin with the Agent's Allowed Origins. Pay particular attention to: