Secure public access
Restrict public access by geography, require verified customer identity, and choose session-resume behavior.
Open Settings → Security to configure controls that apply to public customer surfaces. Public access rules are different from the authenticated Playground, which does not use the public geo or identity gates. Administrators and owners manage these settings.
Restrict by country
Under Geographic Access, enable restrictions and choose either Allow only these countries or Block these countries. Select countries with quick picks, regions, or the country picker, then save. The stored values are ISO two-letter country codes, with a maximum of 250 unique entries.
An empty selection has no restriction effect. In allow-list mode, an unknown visitor country is blocked; in block-list mode, an unknown country is allowed. Use an allow-list only when you can name the customer regions you intend to serve, and verify the real public widget after changing it.
Require customer identity
Identity Verification issues an HMAC secret when enabled. Copy the complete secret when it is shown: later views mask it. Your server creates an HS256 JWT containing a user identifier, then passes that token through the widget identify call. Never place the secret in browser code.
Regenerating the secret invalidates existing tokens and requires users to identify again. Disabling verification stops the requirement but leaves the stored secret. Allow guests controls whether an unidentified public-widget visitor may chat; when it is off, a valid identity token is required. The Help Page and authenticated Playground do not use this public-widget identity gate.
Choose session continuity
The session-resume control offers Always new session, 1 hour, 6 hours, 12 hours, 24 hours, 48 hours, or 7 days. Choose a shorter window for shared devices and a longer one when returning customers benefit from continuity. Save after any change and test with a real public session.