August 21, 2026 · platform

Hosted embeds and browser chat call the VoiceThere sessions API with your project client key. Browsers send an Origin header, so each project now has an Allowed web origins list on the Access page (under the embed snippet). Origins apply only to that project's client key — the API key binds the project for CORS enforcement; forging headers cannot select another project's allowlist.

Try it

Docs: Browser CORS origins
Dashboard: Project → Access → Allowed web origins
VoiceThere dashboard origins (app.voicethere.io, app.voicethere.dev, localhost) stay allowed by default — add only your own site hostnames.

Per-project browser CORS origins

Try it