Origins

Browser calls to the Chat API check allowedOrigins on the published app config. Default * helps first run. Live Hosted should list exact origins (localhost plus production). The service also honors a deployment-level CORS_ORIGINS setting.

This limits which browser origins can call public Chat endpoints from a web page. It is an HTTP browser control, not an application authorization system.

What origins do not replace

  • Secret keys. Keep bsw_*_sec_ off the client. Origins do not make a leaked secret safe.
  • Host-asserted identity. Publishable key + author.id can be forged if the key leaks. Restrict who can load your embed and treat user.id as a trust boundary. See Identity.
  • BYO authz. If you pass a ChatAdapter, your API must authorize writes from your session. CORS on Bootstrapware does not protect your backend.

Practical guidance

  • Set allowedOrigins on the app draft via MCP or the dashboard. Prefer explicit production origins over *.
  • Use test publishable keys (bsw_test_pub_) while iterating; switch live keys when customers hit the embed.
  • Optional apiBaseUrl on the component defaults to https://chat.bootstrapware.co. Point local embeds at your deployed Chat service only when you intend to.

Related: API keys · Identity · Environments · Security