Security¶

Public key¶

data-public-key is safe to publish. It only loads your widget settings and agent; it can't read conversations or change anything.

Allowed domains¶

The widget only loads on your allowed domains, checked from the browser's Origin (or Referer). www. and the bare domain count as one site; other subdomains need their own entry. To add a domain, contact support.

Content security policy¶

Directive	Value
`script-src`	`https://static.kothok.ai`
`connect-src`	`https://backend.kothok.ai` and `wss://backend.kothok.ai`
`img-src`	`https://static.kothok.ai`, the host of your uploaded logo and team photos, your product image hosts, and `data:` for a data-URL logo
`style-src`	`'unsafe-inline'` or a nonce, plus `https://fonts.googleapis.com`
`font-src`	`https://fonts.gstatic.com`

To avoid 'unsafe-inline', pass your nonce:

<script
  src="https://static.kothok.ai/js/widgets.js"
  data-public-key="YOUR_PUBLIC_KEY"
  data-nonce="YOUR_REQUEST_NONCE"
  async>
</script>

data-fonts="false" removes the font entries. Allow the host, not an SRI hash: the script is updated in place.

In the browser¶

The widget renders in a closed shadow root, so your CSS and scripts can't reach it.
It stores a visitor id, preferences and the current chat in localStorage and sessionStorage, under keys starting kothok_.