Chat Widget
Domain Whitelist
Restrict your widget to only load on approved domains.
By default a widget key works on any domain. Enable domain whitelisting to prevent your widget from being embedded on other sites.
Enable whitelisting
- Go to Settings → Widget → Security
- Toggle on Domain whitelist
- Add your allowed domains (one per line):
yoursite.com www.yoursite.com staging.yoursite.com localhost - Save
Add localhost and any staging domains before enabling, or your widget will stop loading in development.
How it works
The Kerabie CDN checks the Referer and Origin headers on every widget load. If the domain isn't in your whitelist, the widget script returns an empty response.
This doesn't prevent someone from making API calls directly (use API key scoping for that), but it stops your chat bubble from appearing on unauthorized sites.