Website widget
Allowed websites
Limit a widget key to your own domains: exact hosts, www, wildcard subdomains, ports, localhost and how matching works.
Reference1 min readUpdated 23 October 2026
A publishable key only works on the websites you list under Allowed websites on the agent's Deploy tab (or the Widget page). The API checks each request's Origin header, or its Referer when there's no Origin, and refuses others with 403 ORIGIN_NOT_ALLOWED. Visitors then see "This chat isn't enabled for this website yet."
Patterns
| You enter | It allows |
|---|---|
example.com | example.com and www.example.com, on any port |
*.example.com | example.com and every subdomain |
shop.example.com | That host only (and www.shop.example.com) |
example.com:8080 | That host on port 8080 only |
https://example.com/pricing | Reduced to the host, example.com; paths don't matter |
localhost or localhost:3000 | Local development |
192.168.1.20 | That IPv4 address |
Rules
- Up to 50 websites per key, one per line.
- Wildcards aren't allowed on
localhostor IP addresses. - The page must be served over http or https.
- SentientOne's own app is always allowed, so the preview and Test on this page work with an empty list.
- With an empty list the widget answers only inside the app. The Deploy tab warns you: "No websites yet, so the widget only answers in the preview here."
- Changes take effect within about 10 seconds.
- Rotating the key keeps the list.
Why an allowlist and not CORS alone
The key in the tag is public, so anyone can copy it. The allowlist means a copied key can't put your agent (and your credits) on someone else's site from a normal browser.
If something goes wrong
It works on www but not on the bare domain
Enter the bare domain (example.com): it covers both. www.example.com alone doesn't cover example.com.
It works locally but not on the staging site
Add the staging host too, for example staging.example.com, or *.example.com for every subdomain.
I saved but it still refuses
Wait about 10 seconds and reload. Check the exact host in the browser's address bar, including any port.
Related
Still stuck?
Email us with what you tried and any request id. A person replies.