# Restrict the agent to your sites with Allowed origins

**Category:** [AI Chat Agent](https://help.totalctrl.app/hc/totalctrl/totalctrl-help-center/en-US/categories/agent)
**Updated:** 2026-08-19

## What "Allowed origins" does

Your AI Support Agent widget is loaded with a public agent key. By default that key works on **any** website, so the widget will run wherever the embed snippet is pasted. **Allowed origins** lets you lock the widget to the specific sites you control, so the key can't be reused on a site you don't own.
### Where to set it

Open your agent, go to the **Configuration** tab, and find the **Allowed origins** box. Enter one origin per line, then **Save Configuration**.
### How to write an origin

An origin is the scheme plus the host (and a port only if you use one) — *no path*. For example:

https://www.yourcompany.com
https://app.yourcompany.com
https://help.yourcompany.com

- List every distinct subdomain you embed on — `www.yourcompany.com` and `app.yourcompany.com` are different origins.
- `http` and `https` are different origins; use the scheme your site actually serves.
- Don't include a trailing path or slash (`https://site.com/help` → just `https://site.com`).

### What happens when it's set

When the list is non-empty, requests from any other site are refused and the widget won't load there. When the list is **empty (the default)**, the widget is allowed on any origin — convenient while you're getting started, and fine if you don't mind the key being usable elsewhere.

**Allowed origins is not the same as CSP.** Allowed origins is enforced by TotalCtrl. A *Content-Security-Policy* is enforced by the browser based on *your site's* headers. If your site has a CSP, you may also need to allow our embed domain in it — see [Why isn't the widget loading on my site?](#)
### Embedding on a totally different domain?

That's fully supported — just add that domain to Allowed origins (or leave the list empty). The widget script and its API are served from `ds.totalctrl.app` and accept requests from any origin you permit.

---

## Related Articles

- [Reading your agent analytics](https://help.totalctrl.app/en-US/articles/agent-analytics)
- [Embed the chat widget](https://help.totalctrl.app/en-US/articles/embed-the-chat-widget)
- [AI Support Agent overview](https://help.totalctrl.app/en-US/articles/ai-support-agent-overview-1)
- [Managing Agent Conversations](https://help.totalctrl.app/en-US/articles/managing-agent-conversations)
- [Add knowledge sources](https://help.totalctrl.app/en-US/articles/add-knowledge-sources)

---
[← Back to TotalCtrl Help Center](https://help.totalctrl.app/en-US/)