Security

Knest provides security controls to ensure your chatbot only works on authorized domains. Learn how to configure domain whitelisting and manage API keys.

Domain whitelisting

Your chatbot only works on domains you explicitly allow. This prevents unauthorized sites from using your API key and consuming your usage quota.

Adding allowed origins

  1. Go to the Integration tab in your project
  2. Find the Allowed Origins section
  3. Add your domain (e.g., https://example.com)

The domain you entered during onboarding is automatically added to allowed origins.

Unauthorized requests

When a request comes from an unauthorized domain, the chatbot will display an error message:

"This domain is not authorized. Please add it to your allowed origins in the Knest dashboard."

If you see this error on your site, check that your domain is correctly added to the allowed origins list.

API keys

Publishable API key

Your publishable API key is used in the widget code.

  • Safe to include in client-side code
  • Protected by domain whitelisting
  • Used to identify your project

Key management

If you believe your API key has been compromised, contact us to regenerate it. Keep in mind that regenerating will invalidate all existing widget installations until you update the key.

Best practices

  • Only add domains you control to the allowed origins list
  • Monitor your analytics for unexpected usage patterns
  • Review domain whitelist periodically and remove unused domains

Next steps