Quotas, origins & keys
Three controls keep your widget secure and your costs predictable: a daily quota, an origin allowlist, and the public key.
Daily quota #
Each site has a daily explanation quota (counted in UTC). Once it's reached, further requests are politely blocked until midnight UTC, and the block is recorded in analytics. Raise or lower it in Settings.
Origin allowlist #
Your public key only works from origins you approve. Add every host the widget runs on, including www and bare variants:
https://acme.com
https://www.acme.com
A request from any other origin renders nothing: this is what stops someone copying your key onto another site.
Local development
Testing on http://localhost? Add that origin (with its port) to the allowlist, or the widget won't appear while you develop.
Rotating the public key #
If a key leaks or you just want a clean slate, use Rotate key on the site. This issues a brand-new key and immediately invalidates the old one. Update your embed snippet afterward, or the widget will stop loading.
The master switch #
The Overview tab has a single on/off switch. Turning the widget off hides it for every visitor instantly (the script still loads but renders nothing), with no code change or redeploy. Flip it back on anytime.