Secure the widget: allowed domains and identity validation (HMAC)

📍 Where to find it: Inboxes → (your Website inbox) → Settings → "Configuration" tab

You can restrict the sites where the bubble can appear (allowed domains) and enable identity validation (HMAC) to guarantee that logged-in visitors really are who they claim to be.

How it works

The "Allowed domains" limit the widget's display to your real domains. Identity validation relies on a secret key (HMAC): your site signs the logged-in user's identity, and Madyis Hub verifies that signature. If you make validation mandatory, only correctly signed visitors can chat. An option also lets you allow display inside a mobile webview.

Step by step

1. Inboxes → Settings of your "Website" inbox → "Configuration" tab.
2. Enter your "Allowed domains" (one per line) then click "Update".
3. Open the "Identity validation" section: copy the secret key (HMAC).
4. Implement the HMAC signature on your site's side with this key (see the linked documentation).
5. Enable "Make validation mandatory" once the signature is in place.
6. Enable "Allow mobile webview" if you embed the widget in a mobile app.

Good to know

• Only enable mandatory validation AFTER you've tested the signature, otherwise your visitors will no longer be able to write.
• Keep the secret key confidential: it must never be exposed in plain text on the browser side.