title: Allowed Origins description: Configure which domains can use your embed key. order: 7

Allowed Origins

Every embed key has an allowed origins list. The Navigic backend only accepts connections from origins on this list. This prevents unauthorized sites from using your key.

What Is an Origin?

An origin is the scheme + hostname + port of a URL:

https://yoursite.com        → origin: https://yoursite.com
https://yoursite.com:8080   → origin: https://yoursite.com:8080
http://localhost:3000        → origin: http://localhost:3000

Path and query string are not part of the origin. https://yoursite.com/blog and https://yoursite.com/app share the same origin.

Adding Origins

1. Go to Settings > Embed in your dashboard
2. Click on your embed key to expand it
3. Add each origin that should be allowed

Common origins to add:

Common Mistakes

Missing www subdomain

https://yoursite.com and https://www.yoursite.com are different origins. If your site is accessible at both, add both.

Wrong protocol

http://yoursite.com and https://yoursite.com are different origins. Most production sites use HTTPS — make sure you add the correct one.

Including a path

Origins don't include paths. Add https://yoursite.com, not https://yoursite.com/chat.

Port mismatch

If your dev server runs on port 5173 (Vite) instead of 3000, add http://localhost:5173.

Multiple Keys

You can create separate embed keys for different environments:

• Production key — allowed origins: https://yoursite.com, https://www.yoursite.com
• Development key — allowed origins: http://localhost:3000, http://localhost:5173

This keeps your production key locked down while giving flexibility in development.

Wildcard Origins

Wildcard origins are not supported. Every origin must be listed explicitly. This is a security measure — wildcard origins would allow any site to embed your widget.