Version Pinning & Origins
Pin a CDN version, restrict allowed origins, and rotate the shared secret
Version pinning
Unversioned bundle URLs always serve the latest release (5-minute hard cache, 24-hour stale-while-revalidate). To lock a build, insert a version segment:
<!-- Latest — auto-updates -->
<script async src="https://cdn.wexio.io/widget/loader.js" data-public-key="pk_live_..."></script>
<!-- Pinned — immutable, never auto-updates -->
<script async src="https://cdn.wexio.io/widget/v1.0.15/loader.js" data-public-key="pk_live_..."></script>Pinned bundles are cached for a year and never invalidated, so a pin is reproducible forever. The same pattern works for widget.js and widget-react.js.
| Strategy | URL shape | When to use |
|---|---|---|
| Latest (recommended) | /widget/loader.js | You want bug-fixes automatically. |
| Pinned | /widget/v1.0.15/loader.js | You need a reproducible build or are validating an upgrade. |
Legacy flat URLs still resolve via CDN rewrites: /loader.js maps to /widget/loader.js, and /loader@1.0.15.js maps to /widget/v1.0.15/loader.js. The /widget/... paths are canonical going forward.
Allowed origins
allowedOrigins restricts which website origins may load the widget with your public key. Each entry is a bare origin — scheme + host (+ port) only, no path, query, or hash:
https://example.com
https://app.example.comAn empty list falls back to the backend's default behaviour. Edit the list in the Brand/Install area. The origin allow-list is enforced server-side and is never exposed in the widget's public config.
The allow-list also scopes WebAuthn: a passkey's relying-party id is derived from the embedding origin and validated against allowedOrigins. See Google & Passkey.
Rotating the shared secret
The shared secret is shown once at creation. To get a fresh one — for example if it leaked or was never copied — use the secret rotation control in the Install area.
- Rotation generates a new secret and reveals it once. Copy it and update your server-side integration.
- Existing page embeds keep working: they reference the public key, not the secret.
- Rotation invalidates the old secret on a staged grace window, so update your backend promptly.
After rotating, re-sign any JWT or HMAC proofs with the new secret.
Self-hosting note
The widget bundles are designed to run from the Wexio CDN. The CDN already sends Access-Control-Allow-Origin: *, so there's no reason to re-host the JavaScript. If you have a strict CSP, allow https://cdn.wexio.io (script) and https://api.wexio.io (connect), plus https://challenges.cloudflare.com when Turnstile is enabled.