Skip to main content
The Char agent only operates on origins you explicitly allow. This guide shows you how to configure allowed domains for your organization.

​
Add an Allowed Domain

  1. Open the Char dashboard
  2. Navigate to Settings → Integration
  3. Under Allowed Domains, click Add Domain
  4. Enter the full origin (e.g., https://app.example.com)
  5. Click Save
The domain is active immediately. No deployment or restart required.

​
Origin Format

Origins must be complete—scheme, hostname, and port (if non-standard): 
https://app.example.com
https://staging.example.com:3000
http://localhost:3000
Omit trailing slashes. Wildcards are not supported.

​
Common Configurations

Production + staging: 
https://app.example.com
https://staging.example.com
Multiple subdomains: 
https://app.example.com
https://admin.example.com
https://support.example.com
Local development: localhost and 127.0.0.1 are allowed by default on any port. You don’t need to add them.

​
Remove a Domain

  1. Open Settings → Integration
  2. Find the domain in the Allowed Domains list
  3. Click the delete icon
  4. Confirm removal
Removal is immediate. Agents on that origin will stop authenticating.

​
Troubleshooting

Agent shows authentication error: Check that the origin in your browser’s address bar exactly matches an allowed domain. Common mismatches:
  • Missing https:// prefix
  • Including a trailing slash
  • Wrong port number
  • Subdomain not listed
Agent works locally but not in production: Verify you’ve added the production origin. localhost is allowed automatically, but https://app.example.com must be added explicitly. CORS errors in console: The allowed domains list only controls Char authentication, not CORS. If you see CORS errors, check that your server’s CORS configuration permits requests from the Char API.