Allow the sites that can embed your widgets

Last updated: August 16, 2026

The Allowed origins list on the Widgets settings page controls which of your web pages are allowed to embed a Nash widget. Nash mints an embed session only for pages on the exact origins you list here — a widget embedded anywhere else is refused a session. Allowing your origin is one of the four things a widget needs before it serves; see embed a Nash widget on your site for the whole sequence.

Find it under Settings ▸ Connections ▸ Widgets, in the Allowed origins section.

Note

You'll need organization-management permissions to change these settings.

Add an origin

Type the origin into the input and select Add origin (or press Enter). Add every site that will embed a widget, including any staging site.

An origin is an exact web origin: scheme://host, plus a port only if it's non-default — for example https://www.your-site.com or https://staging.your-site.com:8443. A few rules the page enforces:

  • Include the scheme. http:// and https:// are different origins. A bare hostname is rejected.
  • No paths, queries, or fragments. Authorization is per origin, not per page, so https://shop.example.com/track is rejected — use https://shop.example.com. A trailing slash is trimmed for you.
  • No wildcards. You can't authorize *.example.com. Add each subdomain as its own origin.
  • No duplicates. An origin already on the list can't be added twice.

If an entry doesn't parse, the page tells you why and shows the corrected form.

Newly added origins show Not saved yet until you save. Origins share one draft with the widget catalog — select Save changes at the bottom of the page to write them. Nothing takes effect until you save.

Remove an origin

Each origin row has a Remove (X) button.

  • Removing an origin you haven't saved yet just drops it — it authorized nothing.
  • Removing a saved origin asks you to confirm first: Remove this origin? New embed sessions will stop being minted for pages on it — running sessions finish out (15 minutes at most). Choose Keep or Remove.

The removal also lands in the draft and is written when you Save changes. After it saves, Nash stops minting new sessions for pages on that origin; sessions already running finish out — up to 15 minutes.

Not the same as the Nash Agent allowlist

This list takes exact origins (scheme, host, and optional port). It is a different setting from the Nash Agent per-agent domain allowlist, which takes bare hostnames and *. wildcards. Adding a site here does not authorize it for Nash Agent, and the reverse is also true.

Related