Ir al contenido
Documentación

Embed Domains

Esta página aún no está disponible en español. Se muestra la versión en inglés.

The Embed page lists the websites allowed to show Querri inside their own pages. Querri checks the list every time an embed session is created.

People still need to sign in, or your server needs an API key, but neither one limits which site the embed runs on.

Who can use this: organization admins. Open Settings from your avatar menu, then Embed in the Security group.

  1. Allowed Domains: one site per line.
  2. The hint under the box: an empty list allows any site, and *.example.com covers every subdomain.
  3. Save Settings: saves the list.
  4. Embed Configurator: opens the visual configurator in a new tab.

Add your sites

Section titled “Add your sites”
  1. In Allowed Domains, enter each site you embed Querri in, one per line. Include staging and test sites you still use.
  2. Click Save Settings. “Embed settings saved successfully.” shows for a few seconds.

Your first domain turns the check on. From then on, embeds on any site you left out stop working, including ones that are already open.

Spaces around an entry and blank lines are dropped when you save. Reset throws away edits you haven’t saved and reloads the saved list.

Want any site to embed Querri again? Empty the box and save.

  1. Allowed Domains: the example entries, a full address and a wildcard.

How entries match

Section titled “How entries match”

Capital letters and a trailing slash don’t matter.

EntryWhat it allows
https://app.example.comOnly that address. The same host over http://, or on another port, doesn’t match.
app.example.comThat host on any scheme or port, including plain http://.
*.example.comexample.com itself and every host ending in .example.com, on any scheme or port.

Use full https:// addresses where you can. A bare host is looser than it looks, and a wildcard is only safe when you control every subdomain.

When the list is checked

Section titled “When the list is checked”

A new embed session always says which site it’s for, its origin. That’s true whether someone signs in through the embed or your server creates the session with an Embed API key.

  • With no domains listed, any site is allowed.
  • If there’s a list but the request doesn’t name a site, Querri refuses it with “origin is required when a domain allowlist is configured for this organization”.
  • A site that isn’t on the list gets “Origin ‘{origin}’ is not in the allowed domains list for this organization”.

Open sessions are checked again whenever they’re validated or refreshed. So when you remove a site, embeds already running there stop at their next check.

What’s recorded

Section titled “What’s recorded”

Each save is recorded in Settings history under the Embedded analytics setting. You can see who saved it and what the list said at each version.

Embed Configurator

Section titled “Embed Configurator”

Below the list, the Embed Configurator card reads “Visually configure the embedded UI, preview it live, and copy the generated snippet.” Open configurator opens it in a new tab. For building an embed in your own app, see the embed SDK.

Good habits

Section titled “Good habits”
  • Add your sites before you share an embed with customers, not after.
  • Remove a site when you stop embedding Querri there.
  • If an embed suddenly stops loading, check Settings history for a recent change to the list.
  • Keep wildcards for domains you own outright.

Next steps

Section titled “Next steps”