Restrict Notiondesk Messenger to trusted domains
Trusted domains let you control which websites are allowed to load your Notiondesk Messenger.
When trusted domains are configured, Messenger only works on approved domains. Attempts to load the same Messenger from another website are blocked.
Use trusted domains when you want to prevent your Messenger from being embedded or reused on websites you do not control.
When to use trusted domains
Trusted domains are useful when:
- Messenger should only appear on your production website
- Messenger is installed inside a private web application
- You have separate production and staging environments
- You identify logged-in users in Messenger
- You want to prevent another website from loading your Messenger ID
For example, if Messenger should only run on:
www.example.com
app.example.comadd those websites to your trusted domains.
Add a trusted domain
Open your Messenger settings in Notiondesk and find the Allowed domains settings.
Add each website where Messenger should be allowed to load.
For example:
www.example.comIf Messenger also runs in your application:
app.example.comadd that domain separately.
Save your changes, then reload the website where Messenger is installed.
What happens on an unauthorized domain
When trusted domains are enabled, Notiondesk checks the website requesting the Messenger configuration.
If the current website is not allowed, Notiondesk blocks the request and Messenger does not initialize.
Nothing is displayed to the visitor.
This means a correct Messenger installation can appear to do nothing when the website is missing from the trusted domains list.
Allow multiple websites
Add every website that legitimately uses the same Messenger.
For example, you might use Messenger on:
www.example.com
app.example.com
staging.example.comEach environment that needs to load Messenger must be allowed.
Only add domains that should have access to your Messenger.
Production and staging environments
If you test Messenger from a staging environment, make sure that environment is also included in your trusted domains.
For example:
app.example.com
staging.example.comYou can remove the staging domain later if it should no longer load Messenger.
Test your configuration
After configuring trusted domains:
- Open an allowed website
- Reload the page.
- Confirm that the Messenger launcher appears
- Open Messenger and verify that it loads normally
- Test another allowed domain if you configured more than one.
If you use the JavaScript SDK, you can also catch initialization failures:
try {
const notiondesk = await initNotiondesk({
messengerId: "YOUR_MESSENGER_ID",
});
} catch (error) {
console.error(
"Could not initialize Notiondesk Messenger",
error,
);
}Messenger works on one subdomain but not another
A Messenger that is allowed on one website should not be assumed to be allowed on every other subdomain.
If Messenger also needs to run on another subdomain, add that website to your trusted domains.
For example, if Messenger works on:
www.example.combut also needs to run on:
app.example.commake sure both are configured.
Trusted domains and identified users
Trusted domains and user identification solve different problems.
Trusted domains control which websites are allowed to load Messenger.
User identification tells Messenger which authenticated customer is currently using your application.
For applications with authenticated customers, you can use both together:
- Restrict Messenger to your application domains.
- Generate signed user tokens on your backend.
- Pass the user token to Messenger after authentication.
See Identify logged-in users in Notiondesk Messenger for the authentication flow.