Security and site permissions
Understand domain checks, the public widget ID, and site security policy.
The widget uses a public ID in its install snippet. It is not a secret and must not be used as an authorization token. Private account information, billing identifiers, and unpublished agent knowledge must stay on authenticated server paths.
Domain checks
Add and enable the site hostname in Domains. The widget configuration service checks the browser origin before returning usable configuration. Keep the domain list current when moving or removing a site. The Domains guide covers setup.
Content security policy
If your site uses a Content Security Policy (CSP), it must permit the Eversolve script from the API origin and the network requests needed by the widget. Start with the browser’s CSP violation report and allow only the Eversolve origins that the installed widget actually uses. Keep the rest of your site policy as restrictive as it needs to be.
Script origin: https://api.eversolve.ioThe exact directive depends on your site policy and the enabled widget features. Test the launcher and a chat request after changing CSP. Avoid broad wildcard allowances.
Report a concern
If you see unexpected widget behavior or suspect a security issue, contact Eversolve support with the affected domain and a description. Do not send passwords, API keys, or visitor transcripts through a public documentation feedback field.
Was this guide helpful?
We keep feedback for 90 days. Read our privacy policy.