Pulse
Control which sites can load Pulse
Pulse only runs on domains you've approved. Here's how the allow-list works and how to add your sites to it.
Colin LawlessCo-founder, CTO3 min readUpdated Jun 9, 2026Your Pulse snippet carries your tenant ID, which means anyone who copies it could try to run your widget on their own site. The allow-list is the guardrail: Pulse only answers on domains you've explicitly approved.
Why the allow-list exists
The widget loads from a public script, so the snippet itself can't be a secret. Instead of trusting the snippet, Pulse checks the domain the request comes from against your approved list on every call. An approved domain gets answers; anything else gets turned away. That keeps your knowledge, your session quota, and your branding tied to your sites.
Add an allowed domain
- Open Pulse → Install.
- Find the domain allow-list.
- Add the exact domain Pulse should run on (for example,
yourbusiness.com). - Save. The widget starts answering on that domain right away.
Add each site you run separately if you have more than one.
Owners and admins only
Adding a domain is restricted to owners and admins. Members can see the embed snippet and the current list, but the add control is hidden for them, and the server rejects the change if it's attempted anyway. If you can't add a domain, ask an owner or admin on your team. See Invite your team and set roles.
What happens on other domains
If the widget is loaded from a domain that isn't on your list, Pulse refuses to answer there. So even if your snippet ends up on someone else's page, it won't serve your knowledge or burn your session quota.
Widget loaded but silent?
The most common cause is a domain that isn't approved, often a www vs. bare-domain mismatch or a staging URL. Confirm the exact host you're testing on is in the allow-list under Pulse → Install.