Website chat embed keys

An embed key lets a website initialize the Infra One chat widget for an organization. It is publishable, starts with pk_, and may appear in page HTML. Infra One accepts it only when the request also supplies a configured Allowed origin. That check restricts normal browser embedding; it does not prove that a non-browser request came from the listed site.

Create a key

1. Open https://agents.infra.one/your-organization-slug/embed-keys.
2. Select New embed key.
3. Enter a Name that identifies the site and environment, such as Marketing website — production.
4. Enter Allowed origins, one origin per line, such as https://www.example.com. At least one allowed origin is required.
5. Select Create key.
6. Use Copy key and configure the website integration that loads the chat widget.

An origin must be a bare HTTP or HTTPS scheme and hostname with an optional non-default port. Do not enter a path, query, fragment, or embedded credentials. Infra One trims whitespace, accepts an empty path or /, and lowercases the scheme and hostname. It removes port 80 only from HTTP origins and port 443 only from HTTPS origins. It preserves non-default ports, including cross-scheme ports such as https://example.com:80 and http://example.com:443. It also restores brackets around an IPv6 host. It does not remove a trailing hostname dot or convert between Unicode and punycode hostnames. Enter the canonical Origin value the browser sends. Production and local development normally need separate origins and preferably separate keys.

Key states

State	Meaning
Active	The key can resolve when used from an allowed origin.
Revoked	The key normally stops resolving immediately. A rare in-flight cache fill can preserve a stale resolution for at most 30 seconds; after that bounded window, the key cannot be used again.

Rotate a key

Select Rotate when a key value must change without changing its name or allowed origins. Rotation atomically revokes the current row and creates a fresh row with a new pk_ value and the same name and origins. Both rows remain visible in the key history: the old row is Revoked and the replacement is Active.

Rotate has no overlap window: it revokes the current key before the replacement can be deployed. Using Rotate causes a brief interruption, so coordinate the rotation and website deployment and deploy the replacement immediately. After rotation, the old key is subject to the same rare in-flight cache-fill race and may keep resolving for at most 30 seconds.

To replace a key without interrupting chat, do not select Rotate. Create a second key with the same allowed origins, deploy and verify it, then select Revoke on the old key. Infra One permits multiple active keys for an organization, so both resolve during the handoff.

Revoke a key

Select Revoke when the site should no longer initialize chat. Normal resolution-cache entries are purged immediately, with the same rare at-most-30-second in-flight race described above. Remove the old value from site configuration, source maps, and deployment variables even though the key is publishable.

Security model

The allowed-origin check is a browser-facing embedding control. A missing, unknown, revoked, or origin-mismatched key fails closed, subject to the bounded revocation race above. A missing Origin header also fails closed. The header can be supplied by a non-browser client, so the allowlist is not authentication, authorization, request provenance, or complete abuse prevention. Establish visitor identity and authorization through the integration’s supported identity flow, not by hiding this key or relying on its allowed origins.