Security & allowed domains

List allowed domains (yoursite.com) in Developer tab > Domains. Off-list, widget and browser calls are blocked. Never expose an admin key on the frontend.

• Allowed domains: yoursite.com (no https), one per line, in Developer > Domains.
• Server-to-server calls: keep your keys backend-side, never in public JS.
• Every exchange stays reviewable conversation by conversation, with tracked advisor handoff.