Approving the domains your agent may run on
Put the bare hostname in Allowed website domain in the agent editor's Appearance section. Garuda compares it to the origin the browser reports, character for character, and refuses any other site.
Last checked against the running product on 30 August 2026.
The allowlist is what stops somebody copying your snippet onto their own site and spending your conversation allowance. Every widget request carries the browser origin, and Garuda checks it before it will hand over the agent or open a session.
Open the agent editor
Go to Agents, open the agent, choose Edit agent, and select the Appearance section. The field is at the bottom, labelled Allowed website domain.
It is not on the Widget screen
Widget, Install shows the approved domains as a read-only list under Publishing and domain access. It is a display, not an editor. The editable field lives in the agent editor only.
Enter the hostname on its own
Type
yourcompany.com. No scheme, no path, no trailing slash. The editor stripshttp://orhttps://and anything after the first slash, and lowercases what is left, so a pasted URL is usually salvaged — but typing the hostname is what makes the result predictable.Values the allowed-domain field accepts and rejects Value Result yourcompany.com Accepted. shop.yourcompany.com Accepted, and matches that subdomain only. yourcompany.com:8443 Accepted. A port is allowed. https://yourcompany.com/ The editor trims it to the hostname before saving. *.yourcompany.com Rejected. Wildcards are not supported. yourcompany.com/shop Rejected once saved: paths are not part of an origin. Save, then publish if the agent is a draft
Save stores it. An agent that is already live picks the new value up on the next widget load. An agent still in Draft needs Publish agent, which refuses to run at all while the field is empty.
Check it on the site itself
Load a page that carries the snippet and open the launcher. If the panel says the assistant is unavailable, the origin your browser sent does not match what you saved — the address bar tells you exactly what it sent.
www and the bare domain are two different origins
A visitor on https://www.yourcompany.com sends a different origin from one on https://yourcompany.com, and Garuda treats them as different. The editor holds one domain, so approve the one your site actually serves and redirect the other to it at your host or DNS provider.
Saving the editor with the field empty clears the allowlist
The Appearance field writes the whole allowed-domain list, so an empty box saves an empty list. A published agent whose allowlist has been emptied will refuse every visitor until a domain is put back and saved.
If it still does not work
The widget loads on your live site but not on staging
Staging is a different hostname, so it is a different origin. There is no way to approve two hostnames from this field; use a second agent for staging, or test against the live hostname.
The widget does not load from a file opened on your computer
A page opened as a local file sends no origin at all, and a request with no origin is refused. Serve the test page over http or https from a hostname you have approved.
Saving is rejected with a message about hostnames
The value has to be a hostname and nothing else: no scheme, path, wildcard, query string, fragment or credentials, and no characters outside letters, digits, dots, dashes and a colon before a port. Retype it as a bare hostname.
You need the chat on several different domains
Create one agent per domain. Each has its own key, its own allowlist and its own snippet, and the plan allows 10 published agents at a time.
Related articles
- Getting startedInstalling the widget on your websiteCopy the one-line script from Widget, Install and paste it before the closing body tag on every page that should show the chat. Step-by-step guides for Webflow, WordPress, Shopify and Framer are on the same tab.
- TroubleshootingMy widget is not showing upFour causes account for nearly every missing widget: the agent is not published, the domain is not approved, the snippet is not really on the page, or the Chat toggle is off. Check them in that order.
- Getting startedCreating your first agentAnswer four setup questions to get a drafted agent, or build one by hand in Agents. Either way it stays a draft until you add an allowed domain and publish it.