Skip to main content
The web-chat widget is keyed to your organization and gated by an allowed origins list — not by keeping any value secret.

​
How the gate works

  • The embed script is public by design (it’s in every visitor’s page source). What it can do is gated server-side: a chat session is only minted when the request’s Origin is on your allowed origins list.
  • Lifting your snippet onto another domain shows the launcher chrome but cannot start a chat — the session request is refused with a 403.
  • You control the allowed list in Web chat → Install. Add exact origins (https://example.com) or a single-label wildcard (https://*.example.com).

​
Install codes (self-service)

To let a site owner or agency install the widget without a Rivvi login, generate an install code on the Install tab. They paste it into the WordPress plugin (or redeem it via the pairing endpoint), which adds their origin to your allowed list and confirms the install. Codes are single-use and short-lived; anyone who merely scrapes your org id can’t self-authorize — only a valid code or an authenticated operator can change the allowed list.

​
Install detection

Rivvi records where the widget is actually observed loading, so the Install tab can tell the difference between:
  • Live — the snippet loaded on an allowed origin, recently.
  • Detected on an unapproved site — the snippet is loading somewhere not on your allowed list. Add it to go live, or ignore it.
  • Went quiet — an allowed site stopped loading the widget (removed or broken).
  • Not installed — allow-listed, but the snippet has never been seen.
Detection never changes your allowed list on its own — observing an origin is not the same as authorizing it.