Customization
Domains
Configure allowed domains to control where Pointer can be used.
Overview
Pointer only works on domains you explicitly approve. This ensures your widget is used securely and only on your authorized websites.
Domain configuration
Accessing domain settings
Configure your allowed domains in the Pointer dashboard:
- Navigate to Settings page on the Pointer dashboard
- Locate the “Allowed origins” section
- Add your domains to the approved list
Security restrictions
Outside of local development environments, Pointer automatically blocks requests from domains that are not explicitly allowed. This security measure prevents:
- Unauthorized usage: Stops other websites from using your Pointer widget
- Data protection: Ensures your knowledge base and analytics remain secure
- Resource control: Prevents unexpected credit consumption from unauthorized domains
Adding domains
Domain format
When adding domains to your allowed list, include:
- Production domains: Your live website URLs (e.g.,
yourdomain.com) - Subdomains: Specific subdomains where you deploy the widget (e.g.,
app.yourdomain.com) - Development domains: Staging or testing environments (e.g.,
staging.yourdomain.com)
Protocol considerations
- HTTPS domains: Include your secure production domains
- HTTP domains: Only if necessary for development or specific use cases
- Local development:
localhostand local IP addresses are automatically allowed during development
Local development environments (localhost, 127.0.0.1) are automatically allowed and don’t need to be explicitly added to your domain list.
Best practices
Troubleshooting
Widget not loading
If the Pointer widget fails to load on your website:
- Check domain list: Ensure your domain is added to the allowed origins
- Verify URL format: Confirm the domain matches exactly (including subdomains)
- Clear cache: Refresh your browser cache and try again
- Check console: Look for CORS or security-related error messages
Common issues
- Subdomain mismatch:
app.yourdomain.comandyourdomain.comare treated as different domains - Protocol differences:
http://andhttps://versions may need separate entries - Trailing slashes: Ensure domain format matches your actual URL structure
Always test widget functionality after adding or modifying domains in your allowed origins list.