Security

Embed origins and CSP allowlists for custom components.

Configure → Security. Three allowlists controlling where your chat can run and what your custom components may talk to.

Configure → Security

Embed origins

Every domain this store's chat is allowed to run on — your website, plus staging, previews, or a second brand site. Each must be a full origin.

The point of the allowlist: your embed runs an LLM on your credits. Restricting the origins it works on stops someone embedding your chat on their own site and consuming your usage. Outside the allowed origins, the embed simply errors.

https://www.example.com
https://staging.example.com

Without this, the panel will not load on that domain. A new store starts with the website you signed up with already on the list, in both its www and non-www spelling.

This list is separate from the Website field under Configure → Basic. Changing your website there does not add or remove anything here — if you move to a new domain, add it to this list yourself.

Trusted script hosts

Origins your custom components may load JavaScript from, as a host:

cdn.example.com

These extend the storefront CSP script-src on top of the Greatstore defaults.

Trusted connect hosts

Origins those scripts and components may fetch from or open WebSockets to. Extends connect-src; each entry produces both http(s) and ws(s) variants, so you do not need to add both.

These lists widen your storefront's content security policy. Add only hosts you control or explicitly trust, and remove entries when a component stops using them.

Related

Building an app