Skip to content
Garuda
Getting started

Approving the domains your agent may run on

Put the bare hostname in Allowed website domain in the agent editor's Appearance section. Garuda compares it to the origin the browser reports, character for character, and refuses any other site.

Last checked against the running product on 30 August 2026.

The allowlist is what stops somebody copying your snippet onto their own site and spending your conversation allowance. Every widget request carries the browser origin, and Garuda checks it before it will hand over the agent or open a session.

  1. Open the agent editor

    Go to Agents, open the agent, choose Edit agent, and select the Appearance section. The field is at the bottom, labelled Allowed website domain.

    It is not on the Widget screen

    Widget, Install shows the approved domains as a read-only list under Publishing and domain access. It is a display, not an editor. The editable field lives in the agent editor only.

  2. Enter the hostname on its own

    Type yourcompany.com. No scheme, no path, no trailing slash. The editor strips http:// or https:// and anything after the first slash, and lowercases what is left, so a pasted URL is usually salvaged — but typing the hostname is what makes the result predictable.

    Values the allowed-domain field accepts and rejects
    ValueResult
    yourcompany.comAccepted.
    shop.yourcompany.comAccepted, and matches that subdomain only.
    yourcompany.com:8443Accepted. A port is allowed.
    https://yourcompany.com/The editor trims it to the hostname before saving.
    *.yourcompany.comRejected. Wildcards are not supported.
    yourcompany.com/shopRejected once saved: paths are not part of an origin.
  3. Save, then publish if the agent is a draft

    Save stores it. An agent that is already live picks the new value up on the next widget load. An agent still in Draft needs Publish agent, which refuses to run at all while the field is empty.

  4. Check it on the site itself

    Load a page that carries the snippet and open the launcher. If the panel says the assistant is unavailable, the origin your browser sent does not match what you saved — the address bar tells you exactly what it sent.

www and the bare domain are two different origins

A visitor on https://www.yourcompany.com sends a different origin from one on https://yourcompany.com, and Garuda treats them as different. The editor holds one domain, so approve the one your site actually serves and redirect the other to it at your host or DNS provider.

Saving the editor with the field empty clears the allowlist

The Appearance field writes the whole allowed-domain list, so an empty box saves an empty list. A published agent whose allowlist has been emptied will refuse every visitor until a domain is put back and saved.

If it still does not work

The widget loads on your live site but not on staging

Staging is a different hostname, so it is a different origin. There is no way to approve two hostnames from this field; use a second agent for staging, or test against the live hostname.

The widget does not load from a file opened on your computer

A page opened as a local file sends no origin at all, and a request with no origin is refused. Serve the test page over http or https from a hostname you have approved.

Saving is rejected with a message about hostnames

The value has to be a hostname and nothing else: no scheme, path, wildcard, query string, fragment or credentials, and no characters outside letters, digits, dots, dashes and a colon before a port. Retype it as a bare hostname.

You need the chat on several different domains

Create one agent per domain. Each has its own key, its own allowlist and its own snippet, and the plan allows 10 published agents at a time.

Back to all help articles

Still stuck?

Every article here is written from the product as it works today. If something on this page does not match what you see in your workspace, trust the product and tell us — include the page you were on and what you expected.