Security & Access Control
Rate limiting, signed widget sessions, and origin allowlisting for the widget and hosted page.
Open Dashboard → Agents → your agent → Security to control how the public widget and hosted page can be used. These settings only apply to widget/hosted-page traffic — not to the dashboard playground, which is already behind your login session.
Rate limiting
Protects against abuse of the unauthenticated widget/hosted-page chat endpoint.
| Setting | Default |
|---|---|
| Enabled | On |
| Max messages | 20 |
| Window | 240 seconds |
| Cooldown after limit reached | 300 seconds |
| Limit-reached message | "Too many messages in a row" |
Rate limiting is on by default for every agent, because widget traffic isn't authenticated. You can tune the thresholds or the message shown to visitors, but turning it off entirely is not recommended for a publicly embedded agent.
Monthly message quota
When your plan's monthly AI response limit is reached, visitors on the widget and hosted page stop receiving AI replies. You can customize the message they see:
| Setting | Default |
|---|---|
| Quota-reached message | "This assistant is temporarily unavailable. Please try again later or contact us directly." |
This message is shown on the widget and hosted page only — not in the dashboard playground. Org owners and admins receive a separate email with usage details and upgrade options (once per billing period per agent).
Signed embed sessions
| Setting | Default |
|---|---|
| Require signed widget session | On |
| Session TTL | 900 seconds (15 minutes) |
When enabled, the widget/hosted-page frontend must present a short-lived, signed session token with every chat request. This prevents someone from scripting requests directly against your chat endpoint without loading the widget iframe first.
Allowed origins
An optional allowlist of parent page origins permitted to embed the widget or load the
hosted page. Use the URL of the site that hosts the embed snippet (e.g.
https://myshop.com), not your Mozo app URL. Examples:
https://example.com
https://app.example.com
*.example.com
Wildcards like *.example.com match any subdomain.
| Allowlist state | Behavior |
|---|---|
| Empty (default) | Any valid http:// or https:// origin may embed |
| Non-empty | Only listed origins (and wildcards) may embed |
Your own Mozo app origin is always implicitly allowed so hosted pages and dashboard previews keep working without extra configuration.
If a widget doesn't load on a specific domain and you use a non-empty allowlist, add that
domain (or a wildcard covering it) and reload. Entries must include the scheme, e.g.
https://example.com.
Allow local testing
| Setting | Default |
|---|---|
| Allow local testing | Off |
When enabled, localhost and 127.0.0.1 on any port may embed the widget even if they are
not in the allowlist. This is useful when testing a production embed snippet from a local HTML
page or dev server while keeping a restrictive production allowlist.
Signed widget sessions and rate limiting still apply. Turn this off when you no longer need local bypass.
Resetting to defaults
The Security page has a Reset to defaults action that restores the values above if you've changed something and want to start over.