VoiceThere

Browser CORS origins

When you embed @voicethere/client on your website, the browser sends an Origin header on POST /v1/sessions. VoiceThere only accepts those requests from origins you trust — plus the VoiceThere dashboard defaults listed below.

Always allowed (platform defaults)

These origins are always permitted and do not need to be added to your project:

  • https://app.voicethere.dev
  • https://app.voicethere.io
  • http://localhost:3000
  • http://127.0.0.1:3000
  • http://127.0.0.1:3100 (local Playwright / dashboard dev)

Add your site origins

  1. Open your project in the dashboard → Access.
  2. Under Embed on your site, find Allowed web origins.
  3. Add each absolute origin — scheme, host, and optional port only (no path). Example: https://app.example.com or https://staging.example.com:8443.

Use your production domain and any staging or preview hostnames where the widget or chat UI runs. Wildcards are not supported.

Example

// After adding https://shop.example.com on the Access page:
const res = await fetch("https://sessions.voicethere.io/v1/sessions", {
  method: "POST",
  headers: {
    Authorization: "Bearer vthc_…",
    "Content-Type": "application/json",
  },
  body: JSON.stringify({ project_id: "<project-uuid>" }),
});

If the page origin is not allowed, the browser receives a CORS error or a 403 from the sessions API. Server-side and CLI callers without an Origin header are unaffected.

Related

← All documentation