Browser CORS origins
When you embed @voicethere/client on your website, the browser sends an Origin header on POST /v1/sessions. VoiceThere only accepts those requests from origins you trust — plus the VoiceThere dashboard defaults listed below.
Always allowed (platform defaults)
These origins are always permitted and do not need to be added to your project:
https://app.voicethere.devhttps://app.voicethere.iohttp://localhost:3000http://127.0.0.1:3000http://127.0.0.1:3100(local Playwright / dashboard dev)
Add your site origins
- Open your project in the dashboard → Access.
- Under Embed on your site, find Allowed web origins.
- Add each absolute origin — scheme, host, and optional port only (no path). Example:
https://app.example.comorhttps://staging.example.com:8443.
Use your production domain and any staging or preview hostnames where the widget or chat UI runs. Wildcards are not supported.
Example
// After adding https://shop.example.com on the Access page:
const res = await fetch("https://sessions.voicethere.io/v1/sessions", {
method: "POST",
headers: {
Authorization: "Bearer vthc_…",
"Content-Type": "application/json",
},
body: JSON.stringify({ project_id: "<project-uuid>" }),
});If the page origin is not allowed, the browser receives a CORS error or a 403 from the sessions API. Server-side and CLI callers without an Origin header are unaffected.
Related
- Browser client — embed snippet and cloud mode
- Control plane API — manage origins via
PUT /projects/:projectId/browser-cors-origins