Skip to content
Dashboard
Open .md fileOpen llms.txtA list of every page, for AI tools

Get started

Allowed origins and CSP

List the sites that may load the widget, and let Iris through your Content Security Policy.

Allowed origins

Section titled “Allowed origins”

In Settings → Widget → Allowed origins, add each origin that loads the widget: the scheme, the host and the port, with no path. A request from any other origin fails with 403 origin_not_allowed.

Allowed origins
https://shop.example.com
https://*.shop.example.com
http://localhost:8080
app://breakdown-lab
  • Use https://. Only a local test origin, such as http://localhost:8080, may use http://, and it needs a port.
  • https://*.shop.example.com allows every subdomain of a domain you own.
  • A desktop app uses a custom-scheme origin: its own scheme and name, such as app://breakdown-lab.

Content Security Policy

Section titled “Content Security Policy”

If your site sends a Content Security Policy, add these sources to it. Settings → Install shows the same list.

Content-Security-Policy
script-src https://cdn.irisdesk.app;
font-src https://cdn.irisdesk.app;
connect-src https://api.irisdesk.app wss://api.irisdesk.app https://190882e8060b31c81155a77d89a95891.r2.cloudflarestorage.com;
img-src https://api.irisdesk.app https://190882e8060b31c81155a77d89a95891.r2.cloudflarestorage.com;
media-src https://190882e8060b31c81155a77d89a95891.r2.cloudflarestorage.com;