Widget keys
A widget key is what lets your embedded widget talk to your chatbot. You create it in the dashboard and paste it into your website's snippet.
Generating a key
Go to Embed & API Keys for your chatbot and generate a key.
The full key is shown once, at the moment you create it. It is stored hashed, so it cannot be shown to you again afterwards. If you lose it, revoke it and generate a new one — there is no recovery.
Allowed domains
Every key carries its own list of allowed domains. This is the setting that stops someone copying your snippet onto their own site and running up your usage.
Set it to the site you are embedding on:
| Entry | Matches |
|---|---|
example.com | Exactly example.com — and not www.example.com |
www.example.com | Exactly www.example.com |
*.example.com | example.com and any subdomain: www., shop., blog. |
* | Any domain at all |
example.com does not cover www.example.com. If your site is reachable at
both, either list both entries or use *.example.com, which covers the bare
domain and every subdomain.
An empty list blocks everything
A key with no allowed domains is not an open key — it is a closed one. Requests from any origin are rejected. Always list at least one domain.
Avoid * on a live key
The wildcard * allows every domain on the internet. It is convenient while you
are testing and it is a liability once you are live. Replace it with your real
domain before launch.
Multiple keys
You can hold several keys per chatbot, each with its own domain list. Useful patterns:
- One key per site. The same chatbot serving
example.comandexample.orggets a key for each, so you can revoke one without touching the other. - One key per environment. A staging key restricted to
staging.example.com, and a production key restricted to your real domain.
Each key tracks its own usage and last-used time, so you can see which sites are actually calling.
Revoking a key
Revoke a key from the dashboard and it stops working immediately. Any widget still using it goes dead.
Revoke when:
- The key was pasted somewhere public — a repository, a support ticket, a screenshot
- A site you no longer control still has your snippet on it
- You are decommissioning a staging environment
- You are rotating keys as routine hygiene
To replace a key without downtime: generate the new one, deploy it to your site, confirm the widget works, then revoke the old one.
Is it safe that the key is visible in my page source?
Yes — and it is unavoidable, because the browser needs it to make the request.
The key is deliberately a public, restricted credential:
- It works only for the one chatbot it belongs to
- It works only from the domains you allowed
- It is rate-limited
- You can revoke it at any moment
- It grants no access to your dashboard, your account, your other chatbots, or your data
It is not an admin key. Your account credentials and the AI provider key are never sent to the browser.
The worst case if someone copies your key is that they try to use your chatbot on their own site — which the domain restriction is there to prevent, and which you would see in that key's usage figures.