Sign in

Install the widget on a company website

An Admin copies a script snippet into the company website and registers the origins that may embed the widget. Only that widget's frame route may be embedded, and only by those origins — every other route in the platform keeps its standard framing/CORS protections.

When this happens: Admin opens the widget's Install tab.

Step by step

  1. 1

    Open Admin — Live Chat — [Widget] — Install.

    EasyCRM shows the snippet <script async src=**https://…/api/live-chat/widgets/{embedKey}/loader.js**></script> and the Allowed Origins list, pre-populated with the widget's Website URL.

  2. 2

    Click Copy snippet and pastes it into the website's page template.

  3. 3

    Confirm Allowed Origins = https://www.acme.example.

    A visitor loads a page; the browser fetches the loader script and, on launcher click, opens the chat frame. Serves the frame with a frame-ancestors policy listing only https://www.acme.example and no X-Frame-Options header on that one route; every other route keeps X-Frame-Options: DENY. EasyCRM records the first successful load and marks the widget Installed.

Other paths

Add a second allowed origin

Add https://staging.acme.example to Allowed Origins for a staging environment. Both origins may now frame the widget; no other origin can.

Rotate the embed key

Click Rotate embed key. The old snippet's URL stops resolving immediately; the Admin re-copies the new snippet into the website.

If something goes wrong

Website embeds from an unregistered origin

A page at an origin not in Allowed Origins loads the snippet. The browser blocks the cross-origin bootstrap call (CORS), and the frame's frame-ancestors policy does not include that origin, so the browser also refuses to render the frame. EasyCrm:LiveChat:OriginNotAllowed is logged for the widget's error list.

Widget key does not resolve

The embedKey in the URL matches no active widget (deleted, deactivated, or mistyped). The frame route falls back to frame-ancestors 'none', behaving like any other route; nothing renders.

Good to know

  • Only the widget's frame route may be framed, only by that widget's Allowed Origins; every other route keeps DENY.
  • The widget's API traffic is exempt from the platform's default CORS allow-list only on its own dedicated route group, resolved per-widget.
  • An origin outside Allowed Origins is rejected at both the CORS layer and again inside the bootstrap call.