Secure public access
Restrict public access by geography, require verified customer identity, and choose session-resume behavior.
Open Settings → Security to configure controls that apply to public customer surfaces. Public access rules are different from the rules for the authenticated Playground. The Playground does not use the public geo or identity gates. Administrators and owners manage these settings.
Restrict by country
Under Geographic Access, enable restrictions. Then choose Allow only these countries or Block these countries. Select countries with quick picks, regions, or the country picker. Then save your changes. The stored values are ISO two-letter country codes. You can store a maximum of 250 unique entries.
An empty selection does not restrict access. In allow-list mode, the system blocks an unknown visitor country. In block-list mode, the system allows an unknown visitor country. If you can name the customer regions that you serve, use an allow-list. After you change this setting, check the real public widget for the correct result.
Require customer identity
When you enable Identity Verification, the system issues an HMAC secret. When the screen shows the secret, copy the whole secret. Later views hide the secret. Your server creates an HS256 JWT that contains a user identifier. Then your server sends the token to the widget identify call. Do not place the secret in the browser code.
If you regenerate the secret, existing tokens become invalid. Users must identify again. If you disable verification, the requirement stops. The system keeps the stored secret. Allow guests controls whether an unidentified visitor to the public widget can chat. If Allow guests is off, the widget requires a valid identity token. The Help Page and the authenticated Playground do not use this identity gate for the public widget.
Choose session continuity
The session-resume control offers Always new session, 1 hour, 6 hours, 12 hours, 24 hours, 48 hours, or 7 days. For shared devices, choose a shorter window. If returning customers benefit from continuity, choose a longer window. After you make a change, save it. Then test the setting with a real public session.