Why a public key is not enough
Your project key ships inside a script tag on a public page. Anyone can read it. That is fine — it is designed to be public — but it means the key alone cannot be the thing that authorizes a write.
So BugLoop checks a second signal: the Origin header. Browsers set it on every cross-origin request and page JavaScript cannot forge it. A submission is accepted only when its Origin is on your project's allowlist.
What counts as an origin
An origin is scheme, host, and port — nothing else. No path, no trailing slash, no query string. https://acme.com and https://www.acme.com are different origins, and so are http:// and https:// versions of the same host.
- https://acme.com — the apex domain
- https://www.acme.com — the www subdomain, if you serve it
- https://*.vercel.app — any single-level subdomain, for preview deployments
- http://localhost:3000 — local development, including the port
Wildcards
A wildcard is supported in the leftmost label only, and it matches exactly one label. https://*.acme.com matches https://staging.acme.com. It does NOT match https://a.b.acme.com, it does NOT match the bare apex https://acme.com, and it never matches https://acme.com.attacker.test. List the apex separately if you need it.
Prefer exact origins in production. Use wildcards for preview environments where the hostname changes on every deploy — and note what https://*.vercel.app actually admits: every preview host on vercel.app, including ones that are not yours. It is the right entry while a branch URL changes on every push, and the wrong one to leave in place afterwards.
What happens when an origin is rejected
The config endpoint returns 403 and the widget silently does not render. Your visitors see nothing broken. The rejection is recorded in the server logs with the offending origin so you can spot a misconfiguration quickly.