> ## Documentation Index
> Fetch the complete documentation index at: https://docs.usechar.com/llms.txt
> Use this file to discover all available pages before exploring further.

# Configure Allowed Domains

> Specify which origins can embed the Char agent

The Char agent only operates on origins you explicitly allow. This guide shows you how to configure allowed domains for your organization.

## Add an Allowed Domain

1. Open the [Char dashboard](https://app.usechar.ai)
2. Navigate to **Settings** → **Integration**
3. Under **Allowed Domains**, click **Add Domain**
4. Enter the full origin (e.g., `https://app.example.com`)
5. Click **Save**

The domain is active immediately. No deployment or restart required.

## Origin Format

Origins must be complete—scheme, hostname, and port (if non-standard):

```
https://app.example.com
https://staging.example.com:3000
http://localhost:3000
```

Omit trailing slashes. Wildcards are not supported.

## Common Configurations

**Production + staging:**

```
https://app.example.com
https://staging.example.com
```

**Multiple subdomains:**

```
https://app.example.com
https://admin.example.com
https://support.example.com
```

**Local development:**

`localhost` and `127.0.0.1` are allowed by default on any port. You don't need to add them.

## Remove a Domain

1. Open **Settings** → **Integration**
2. Find the domain in the **Allowed Domains** list
3. Click the delete icon
4. Confirm removal

Removal is immediate. Agents on that origin will stop authenticating.

## Troubleshooting

**Agent shows authentication error:**

Check that the origin in your browser's address bar exactly matches an allowed domain. Common mismatches:

* Missing `https://` prefix
* Including a trailing slash
* Wrong port number
* Subdomain not listed

**Agent works locally but not in production:**

Verify you've added the production origin. `localhost` is allowed automatically, but `https://app.example.com` must be added explicitly.

**CORS errors in console:**

The allowed domains list only controls Char authentication, not CORS. If you see CORS errors, check that your server's CORS configuration permits requests from the Char API.