Origins

Browser calls to the Feedback API are subject to CORS. The service uses the CORS_ORIGINS setting (comma-separated origins, or * for open development). Production deployments should list the exact origins of apps that embed Feedback.

This limits which browser origins can call public Feedback endpoints from a web page. It is an HTTP browser control, not an application authorization system.

What origins do not replace

  • Secret keys. Keep bsw_*_sec_ off the client. Origins do not make a leaked secret safe.
  • Host-asserted identity. Publishable key + author.id can be forged if the key leaks. Restrict who can load your embed and treat user.id as a trust boundary, see Identity.
  • BYO authz. If you pass a FeedbackAdapter, your API must authorize writes from your session. CORS on Bootstrapware does not protect your backend.

Practical guidance

  • Prefer explicit production origins over *.
  • Use test publishable keys (bsw_test_pub_) while iterating; switch live keys when customers hit the embed.
  • Optional apiBaseUrl on the component defaults to https://feedback.bootstrapware.co: point local embeds at your deployed Feedback service only when you intend to.

Related: API keys · Identity · Environments · Security