Your widget is initialised with an API key that ships in your frontend, so anyone who reads your page source has it. Two settings under your project's security section decide where that key is actually accepted.
The allowlist names the sites permitted to load your widget. It starts empty, and an empty list means no restriction — the widget loads anywhere. Add one domain and only the listed domains work from then on.
Worth setting for any production project. Without it, someone can embed your widget on their own site, and the conversations that arrive will look like yours.
You can also restrict access by country, using a block list, an allow list, or both. It's used to cut spam from regions you don't serve, and to keep the widget out of markets where you don't operate.
The rules apply in a specific order, which matters when you use both:
With neither list set, everyone gets through.
A country on the block list is refused, even if it also appears on the allow list.
If the allow list has any entries at all, every country not on it is refused.
So an allow list is a whitelist: adding one country silently blocks the rest of the world. Use the block list when you want to exclude a few places, and the allow list only when you genuinely serve a fixed set of markets.
From the visitor's IP address. That has two consequences worth knowing.
When the location can't be determined, access is allowed rather than refused — the policy fails open, so an unrecognised address doesn't lock a real customer out. And a customer travelling, or on a VPN, is judged by where they appear to be, not where they live. Someone on your allow list can find themselves shut out from an airport.
