Skip to content
Toado Docs

Widget security

The widget is public-facing. Secure it with allowed origins, Toado’s abuse controls, careful capture settings, and a tested Content Security Policy (CSP).

Widget Security section showing the off switch, public-link controls, privacy recipient, and policy URL.

Approve detected origins

After deployment, open the site and return to Project Settings → Widget → Install. Review the detected origin, approve it, and save. Origins include scheme, host, and non-default port: https://app.example.com and http://app.example.com:3000 are different.

An allowlist prevents other browser origins from embedding your key. It cannot stop a custom script from imitating browser requests, so CAPTCHA and rate limits remain important.

CAPTCHA and rate limits

Anonymous embedded and hosted-link submissions use CAPTCHA where applicable and server-side rate limits. A Team-mode widget with a locked, non-empty origin allowlist may skip visitor CAPTCHA; origin checks and rate limits still apply.

Content Security Policy

Copy the guidance generated for the current configuration. Merge its sources into existing script-src, connect-src, style-src, and img-src directives—do not replace whole directives. External icons can require an additional image origin. Test the effective response header after clearing browser and CDN caches.

Sensitive data

Choose the least capture depth that meets the debugging need. Toado masks form fields in screenshots and filters known sensitive values before upload, but no automated filter understands every application-specific secret. Avoid unnecessary personal questions, configure an accurate privacy-policy link and recipient name, and test representative pages.

The customer operating the widget decides what to collect and is responsible for required notice and consent. See Data retention for current policy status.

Turn the widget off

Turn off Widget is on and save. New reports are rejected immediately, although already-open pages can show the cached launcher for up to five minutes.

Rotate the widget key

  1. Go to Project Settings → Widget → Security.
  2. Rotate the key and confirm.
  3. Copy the newly generated snippet.
  4. Replace the old snippet in every environment and deployment template.
  5. Deploy, open each site, confirm detection, and submit a test.

Rotation invalidates every use of the previous key immediately. There is no overlap window.

Public link is on enables a separate Toado-hosted report page using the same reporting infrastructure. It does not install a launcher. Hosted links retain their own CAPTCHA behavior and appear with a Report link source badge.