Setup
The Setup group — General config, Security (allowed origins & shared secret), and Install
The Setup group holds operational configuration: the widget's name and behaviour, security, and the install snippets. It has three sub-tabs — General, Security, and Install.
General
| Setting | Detail |
|---|---|
| Widget name | Internal label (e.g. "Wexio Web Widget"). Visitors never see this — it's just how the integration is labelled in the dashboard. |
| Default tab | Which tab the widget opens on — Home, Messenger, Help, News, or Profile. If it points at a tab you've disabled under Surfaces, the widget falls through to the first enabled tab. |
| Disable widget | Temporarily hide the widget on all sites without deleting it. Re-enable any time; the embed code stays valid. |
| AI auto-reply | How the AI replies to visitor messages when no flow matches. Pick the mode (organisation default, a specific assistant, or off); when you choose a specific assistant, select which AI assistant answers. |
| Bot protection | Cloudflare Turnstile — require an invisible CAPTCHA on visitor sign-in. Turn it on if you see abuse. See Sessions → Bot protection. |
Security
| Setting | Detail |
|---|---|
| Allowed origins | The domains where the widget is allowed to load (e.g. https://wexio.io, https://example.com). Leave empty to allow any origin — not recommended. Click Add origin to add one. See Allowed origins. |
| Shared secret | The server-side secret used for the authenticated visitor handshake. Never expose it in the browser. Click Rotate secret if it leaks — see the rotation notes below. |
The shared secret is server-to-server only. It signs visitor identity proofs (JWT / HMAC); a leaked secret lets anyone impersonate your visitors. Rotating invalidates the old secret, so update your backend before (or immediately after) rotating.
Visitor sign-in methods (Require sign-in to chat, Sign in with Google, Passkey sign-in) are not on this sub-tab — they live under Surfaces → Visitor authentication. This Security sub-tab is only allowed origins and the shared secret.
Install
The third Setup sub-tab holds your public key and ready-made embed snippets. It's covered in its own section:
Related
- Authentication — identify visitors with the shared secret.
- Allowed origins & rotation — the full origin-allowlist and secret-rotation walkthrough.
- Surfaces — tab toggles and the visitor sign-in methods.