Restrict and secure the widget: allowed domains and identity (HMAC)

You can control where your widget loads and guarantee the identity of your logged-in visitors. Go to Settings → Inboxes → (Website inbox) → Configuration.

Allowed domains

List the allowed domains that can load the widget. The widget will refuse to show elsewhere — useful to prevent it being copied onto another site.

Identity validation (HMAC)

If you identify your visitors (customers logged into your site), enable identity validation. You sign the visitor's identifier with your HMAC secret key (shown here): Madyis Hub then verifies that one visitor can't impersonate another.

Good to know: identity validation is recommended as soon as the widget is used by logged-in users (customer area, app).