Secure a deployment: websites, limits and history

A deployment is public by design: anyone who loads your website can chat. These settings, on the deployment's Settings tab, control who can connect and how much they can use. They apply to website widget, hosted page and API deployments alike.

Allowed websites#

Allowed websites → Websites (optional) lists the websites that may show this deployment's chat, one address per line, with https://:

https://example.com
https://app.example.com

• Leave it empty to allow any website. * also allows any website.
• Addresses are exact, so https://example.com and https://www.example.com are separate entries. Enter the address with no path or trailing slash, and add the port if your site uses one, such as http://localhost:3000.
• You can add up to 100 addresses.
• The check applies to browsers. Calls from your own servers aren't affected.

The deployment ID and public key in your snippet are public, so anyone can copy them. Allowed websites is what keeps another site from running your chat.

If you use the deployment's hosted page or Preview and they can't chat, add the page's own address too, such as https://your-link.help.chat.

Traffic limits#

Optional caps across all visitors of the deployment, counted per minute or per hour:

Default (empty) relies on help.ai's platform-wide protection. Over a limit, requests are turned away until the minute or hour is up.

Message and file size#

• Maximum message length: characters in one visitor message, up to 1,000,000. Presets: 1,000, 4,000, 8,000, 16,000 and 32,000. Longer messages are turned away.
• Maximum file size: megabytes per file, up to 1,024. Presets: 1, 5, 10, 25 and 100 MB. help.ai's own limit of 10 MB per file still applies, so a bigger value has no effect.

Empty fields keep the defaults.

Conversation history#

• Keep conversations: when it's off, each visit starts a new conversation, and the widget hides its history button. Earlier conversations stay stored.
• Messages per conversation (optional) and Conversations per visitor (optional): how many of the newest messages, and of a visitor's newest conversations, the widget shows, up to 10,000. Older ones stay stored. Choose a preset (50, 100, 200 or 500 messages; 10, 25, 50 or 100 conversations), enter your own number, or keep No cap.

Keys#

Keep the secret key on your own server. Never paste it into website code. The Install tab masks it until you select the eye icon.

A deployment's keys can't be changed. If the secret key leaks, create a new deployment, install its snippet, and delete the old deployment.

Switch it off#

To take a deployment offline without deleting it, turn off Live under Availability, or choose Disable from its row menu in Deployments. A deployment also stops answering while its AI agent is disabled.

To remove it, choose Delete from the row menu. Public access through it stops working.