Which domains may load your widget?
How domain allowlisting for your chat widget works technically and where it is maintained.
Last verified: 2026-07-20
So that your chat widget can only be loaded on your own website and not on third-party sites, Zentor App checks the origin domain of every request against a stored allowlist. This list is maintained by Zentor when your widget is created — there is currently no self-service function under "Settings" that lets you add or remove domains yourself.
Step by step
- Communicate the domain(s) to ZentorTell your Zentor contact which domain(s) your widget should load on — this happens during setup or for a later change.
- Widget is created with domain allowlistZentor creates your widget with the approved domain in its configuration. A widget can have multiple domains approved at once.
- Insert the embed codeInsert the embed code you received on the approved domain (see "Embed the chat widget on your website").
- Verify it worksOpen your website on the approved domain — the widget should load. On a non-approved domain it stays blocked.
Expected result
Your widget loads exclusively on the domain(s) you reported to and had approved by Zentor.
Common error cases
The widget does not load on my website, a 403 error appears in the browser console.
Cause: The calling domain is not on the widget's allowlist (error code WIDGET_ORIGIN_DENIED).
Resolution: Check whether you reported the exact correct domain (incl. www./without www., http/https) to Zentor, and contact your Zentor contact to correct it.
I want to approve an additional domain (e.g. a staging environment) but cannot find a setting for it.
Cause: Domain approvals are maintained exclusively by Zentor during widget configuration; there is no self-service editing afterward.
Resolution: Tell your Zentor contact about the additional domain.
The widget loads on any domain, even non-approved ones.
Cause: If no domain at all is stored for a widget, no restriction technically applies — every origin is accepted.
Resolution: This is an edge case from missing configuration; contact Zentor to have a domain restriction stored.