VoiceThere

Browser CORS origins

When you embed @voicethere/client on your website, the browser sends an Origin header on POST /v1/sessions. VoiceThere only accepts those requests when the page origin is listed on this project's Access page — plus the VoiceThere dashboard defaults listed below. Registering an origin on project A does notauthorize browser calls that use project B's client key.

Always allowed (platform defaults)

These origins are always permitted and do not need to be added to your project:

  • https://app.voicethere.dev
  • https://app.voicethere.io
  • http://localhost:3000
  • http://127.0.0.1:3000
  • http://127.0.0.1:3100 (local Playwright / dashboard dev)

Add your site origins

  1. Open your project in the dashboard → Access.
  2. Under Embed on your site, find Allowed web origins.
  3. Add each absolute origin — scheme, host, and optional port only (no path). Example: https://app.example.com or https://staging.example.com:8443.

Use your production domain and any staging or preview hostnames where the widget or chat UI runs. Wildcards are not supported.

Example

// After adding https://shop.example.com on this project's Access page:
const res = await fetch("https://sessions.voicethere.io/v1/sessions", {
  method: "POST",
  headers: {
    Authorization: "Bearer vthc_…",
    "Content-Type": "application/json",
  },
  body: JSON.stringify({ project_id: "<project-uuid>" }),
});

The client API key is bound to a single project. CORS allowlist checks use that key's project, not headers you could forge — there is no X-Project-Id header. The project_idin the JSON body must match the key's project. Browsers send an unauthenticated OPTIONS preflight first; the sessions API reflects your page origin so the preflight succeeds, then enforces the allowlist on the authenticated POST.

If the page origin is not allowed for that project, the browser receives a CORS error or a 403 from the sessions API. Server-side and CLI callers without an Origin header are unaffected.

Related

← All documentation