Restrict Notiondesk Messenger to trusted domains

Control which websites can load your Notiondesk Messenger by restricting it to trusted domains.

3 min read

Restrict Notiondesk Messenger to trusted domains

Trusted domains let you control which websites are allowed to load your Notiondesk Messenger.

When trusted domains are configured, Messenger only works on approved domains. Attempts to load the same Messenger from another website are blocked.

Use trusted domains when you want to prevent your Messenger from being embedded or reused on websites you do not control.

When to use trusted domains

Trusted domains are useful when:

  • Messenger should only appear on your production website
  • Messenger is installed inside a private web application
  • You have separate production and staging environments
  • You identify logged-in users in Messenger
  • You want to prevent another website from loading your Messenger ID

For example, if Messenger should only run on:

www.example.com
app.example.com

add those websites to your trusted domains.

Add a trusted domain

Open your Messenger settings in Notiondesk and find the Allowed domains settings.

Add each website where Messenger should be allowed to load.

For example:

www.example.com

If Messenger also runs in your application:

app.example.com

add that domain separately.

Save your changes, then reload the website where Messenger is installed.

What happens on an unauthorized domain

When trusted domains are enabled, Notiondesk checks the website requesting the Messenger configuration.

If the current website is not allowed, Notiondesk blocks the request and Messenger does not initialize.

Nothing is displayed to the visitor.

This means a correct Messenger installation can appear to do nothing when the website is missing from the trusted domains list.

Allow multiple websites

Add every website that legitimately uses the same Messenger.

For example, you might use Messenger on:

www.example.com
app.example.com
staging.example.com

Each environment that needs to load Messenger must be allowed.

Only add domains that should have access to your Messenger.

Production and staging environments

If you test Messenger from a staging environment, make sure that environment is also included in your trusted domains.

For example:

app.example.com
staging.example.com

You can remove the staging domain later if it should no longer load Messenger.

Test your configuration

After configuring trusted domains:

  1. Open an allowed website
  1. Reload the page.
  1. Confirm that the Messenger launcher appears
  1. Open Messenger and verify that it loads normally
  1. Test another allowed domain if you configured more than one.

If you use the JavaScript SDK, you can also catch initialization failures:

try {
  const notiondesk = await initNotiondesk({
    messengerId: "YOUR_MESSENGER_ID",
  });
} catch (error) {
  console.error(
    "Could not initialize Notiondesk Messenger",
    error,
  );
}

Messenger works on one subdomain but not another

A Messenger that is allowed on one website should not be assumed to be allowed on every other subdomain.

If Messenger also needs to run on another subdomain, add that website to your trusted domains.

For example, if Messenger works on:

www.example.com

but also needs to run on:

app.example.com

make sure both are configured.

Trusted domains and identified users

Trusted domains and user identification solve different problems.

Trusted domains control which websites are allowed to load Messenger.

User identification tells Messenger which authenticated customer is currently using your application.

For applications with authenticated customers, you can use both together:

  1. Restrict Messenger to your application domains.
  1. Generate signed user tokens on your backend.
  1. Pass the user token to Messenger after authentication.

See Identify logged-in users in Notiondesk Messenger for the authentication flow.

Related articles

Was this page helpful?