Allowed domains

By default, any website can display your chat if it has your integration code. Allowed domains restrict that to your own sites. Dashboard → project Settings → Allowed domains.

What you can enter

• example.com, www.example.com: exact host;
• https://www.Example.com/path?x: pasted URLs are cleaned up (lowercase, scheme, path, query and port removed, internationalised names converted to punycode, trailing dot removed) → www.example.com;
• *.example.com: every sub-domain, at any depth, but not example.com itself. Add both to cover both;
• an IP address, as is.

Refused (400 INVALID_DOMAIN): empty input, a wildcard anywhere but at the start (ex*.com, *.*.com), a name without a dot (except localhost), more than 253 characters. At most 50 domains per project (400 DOMAIN_LIMIT_EXCEEDED); duplicates are ignored.

You can also fill Where will you add it? when creating an integration: the domain is added to the list in the same step.

Localhost

Allow localhost (for development) (on by default) accepts localhost, 127.0.0.1, [::1] and *.localhost on any port, as long as the list isn’t empty. Turn it off for a production-only project.

How it’s enforced

• Empty list: no restriction.
• Otherwise, every chat request (integration, channel, history, live stream, message, typing, upload) checks the page that displays the chat:
  • from the embed script or @komozu/react, the browser’s Origin header;
  • from the hosted iframe, the page that contains the iframe (sent by the chat itself);
  • with no Origin at all (a call from a server or a script), the request is allowed.
• A refused page gets 403 DOMAIN_NOT_ALLOWED: the embed script logs [Komozu] This domain isn't allowed for this project. Add it in Settings → Allowed domains. and renders nothing; the iframe shows “This chat can’t be displayed on this site.”
• The dashboard itself (its test page) is always allowed.
• The server API and the dashboard are never restricted by domains.

The hosted iframe

The chat page (embed.komozu.com) tells the browser which sites may display it (Content-Security-Policy: frame-ancestors): your allowed domains on any port, localhost, 127.0.0.1 and *.localhost when Allow localhost is on, and the dashboard. On any other site the browser refuses to show the iframe and prints the reason in its console; the page never loads.

• The browser checks every frame around the chat, not only the top page. If your site builder puts custom code inside its own iframe on another domain, add that domain too.
• [::1] is accepted by the API but can’t be written in this header: use localhost to test the iframe locally.
• A change to the list applies to iframes loaded up to 30 seconds later; an open chat keeps running until reloaded.

Members-only conversations

For conversations only your signed-in users should read, use Members or Private channels (identify-users.md).