Security Guide

Securing your widget's webhook

Connect • Section 2.3

2.3 Security: Domain Lock & Origin Whitelisting

Protect your n8n webhook against unauthorized scraping, origin spoofing, and replay attacks.

Domain lock origin normalization.
Screenshot 1: Real Domain Lock configuration with origin validation and Save button.
Domain lock and webhook interface.
Screenshot 2: Real Connect tab interface with origin domain binding.

Specify your official website domain in the Domain lock field. Stylchat normalizes this value and refuses to initialize the widget on any unauthorized host.

  • Domain lock: The one domain this widget may run on — a copied snippet stops working anywhere else. Type over it and save to move the lock; use a second widget for a second site. It does not hide your webhook URL, which is always visible in your page source.
  • Signing secret: The key used to sign the stylchatToken sent with every message. Paste it into an n8n credential to verify that requests really came from your widget. Keep it private — anyone holding it can forge a valid token. If it leaks, rotate it here and update your n8n credential to match.

See the full Help for setup, customization, and billing.