Widget keys and allowed domains
What the public widget key is, how to restrict it, and when to rotate it.
What the public widget key is, how to restrict it, and when to rotate it.
The widget key
Every live-chat channel has a key in the format lw_…. It is public by design: it ships in your site's HTML so the widget can identify which workspace to connect to.
It grants no access to your data. The key only lets a page boot the chat.
Allowed domains
By default a new widget accepts boot calls from any domain. For production, tighten the allowlist in the widget settings to the exact domains where you embed it:
shop.example.com
*.staging.example.comThe widget then refuses to boot anywhere else. That prevents a third party from copying your snippet onto an unrelated site.
Rotating a key
If a key ends up somewhere it should not be, rotate it from the channel settings. The old key stops working immediately; update the snippet on your site with the new one.
One widget per surface
Create a separate widget channel per site or environment (production store, staging, landing pages).
- ·Own key, allowlist and settings — each widget channel gets its own.
- ·Channel name on tickets — so you know where a conversation started.
A public key is fine — as long as it only boots where you embed it.