Lock the widget to your sites

Allowed origins are the sites where your widget can run. Set them so that a copied key does not work on other sites.

Only workspace Admins can change this. Members see the current values without edit controls.

Set your allowed origins

Open the widget settings

Select Settings in the dashboard sidebar. Find the Widget card.

Enter your sites

Find Allowed origins. Enter one site on each line. Commas also work.

Save

Select Save widget settings.

The helper text in the dashboard says:

One per line. The widget only works on these sites. Leave empty to allow any site (fine for testing, not for production).

Rule	What it means
Exact match	The origin must match the site exactly. Wildcards do not work.
Scheme and port matter	`https://example.com` and `http://example.com` are different origins. A different port is also a different origin.
`www` is separate	`https://example.com` does not cover `https://www.example.com`. Add both.
No paths	Enter only the host, for example `https://example.com`. Do not add a path.
Bare hosts	If you enter a host with no scheme, Paperlink AI adds `https://`.
Maximum	You can add up to 50 origins.
Empty list	An empty list allows any site.

When a site is not in your list, the widget shows this message:

This website isn’t allowed to use this assistant.

Add your staging host to the list too. Then the widget also works when you test before launch.

Learn how origins and Turnstile protect your key.