Security

Secure API keys

Public API keys (pk_live_...) are used to authenticate your widget embed. Keys are validated server-side on every request.

CSS isolation

The chat UI renders inside a sandboxed iframe. Your page styles don't leak in and the widget styles don't leak out.

Domain allowlisting

Configure allowed domains in the Gydr Console to restrict where your widget can be embedded. Requests from unauthorized domains are blocked server-side.

Custom domain binding

When a widget is served from a custom chatbox domain (Growth plan and above), that domain is bound server-side to its owning account. A widget belonging to a different account cannot be rendered on that hostname, regardless of the allowedDomains setting. This ownership check runs first and independently — it is a platform boundary, not a customer-configured control.

Singleton enforcement

Only one widget instance can exist at a time. Duplicate calls return the existing instance instead of creating new DOM elements.