---
schema_version: "1"
id: 6e5d815fa6c3caeba6c3bb595ec2df3a1aba00fb10a6bed7e4c34ad92062dd54
title: Add Your Website to the CORS Allowlist
collection: admin
version: current
locale: en-us
portal_url: https://docs.salesforce.com/admin/current/en-us/service/264-0-0/embedded_chat_cors_allowlist.md
canonical_url: https://help.salesforce.com/s/articleView?id=service.embedded_chat_cors_allowlist.htm&release=264.0.0&type=5
source_site: help.salesforce.com
content_type: documentation
content_hash: 9c8f6549d775a9e139b4067ef75e273e2be4baa9f2044a16a7dbab41cfa61764
description: Add the URLs of the web pages where you intend to add the chat window to the CORS allowlist in your org. The web page where you add the chat window is the page that customers use to access chat.
products:
  - Service Cloud
release: "264"
---
# Add Your Website to the CORS Allowlist

Add the URLs of the web pages where you intend to add the chat window to the CORS allowlist in your org. The web page where you add the chat window is the page that customers use to access chat.

### Required Editions

<table class="slds-table slds-table_bordered slds-max-medium-table_stacked slds-m-bottom_small edition"><colgroup><col></colgroup><tbody><tr class=""><td class="slds-cell-wrap" style="vertical-align:top;"><a href="https://help.salesforce.com/s/articleView?id=service.legacy_editions.htm&amp;language=en_US" target="_blank">View supported editions</a>.</td></tr></tbody></table>

<table class="slds-table slds-table_bordered slds-max-medium-table_stacked slds-m-bottom_small permission">
        <colgroup>
          <col style="width:50%">
          <col style="width:50%">
        </colgroup>
        <thead class="slds-text-title_caps ">
          <tr class="">
            <th scope="colgroup" class="slds-cell-wrap" colspan="2" style="text-align:center;vertical-align:top;" id="d27734e55">User Permissions
              Needed</th>
          </tr>
        </thead>
        <tbody>
          <tr class="">
            <td data-label="User Permissions Needed" class="slds-cell-wrap" style="vertical-align:top;" headers="d27734e55 ">To set up Embedded Chat:</td>

            <td class="slds-cell-wrap" style="vertical-align:top;" headers="d27734e55 ">Customize Application AND Modify Metadata</td>

          </tr>
        </tbody>
      </table>

![Important](https://sf-zdocs-cdn-prod.zoominsoftware.com/tdta-service-support_legacy-264-0-0-production-enus/081af4ec-6c06-4d4b-9443-cb3516bbc46d/images/icon_important.png)

Important

Legacy Chat will be retired on February 14, 2026. To avoid service interruptions to your end users, switch to enhanced Chat (formerly Messaging for In-App and Web). Enhanced Chat offers many of the legacy Chat [features that you love](https://help.salesforce.com/s/articleView?id=service.miaw_replacing_chat_considerations.htm&language=en_US) plus asynchronous conversations that can be picked back up at any time. Learn about migrating in [Help](https://help.salesforce.com/s/articleView?id=service.miaw_replacing_chat_considerations.htm&type=5&language=en_US) and [Trailhead](https://trailhead.salesforce.com/content/learn/modules/migrating-from-legacy-chat-to-enhanced-chat).

You can use HTTP and HTTPS domains with Embedded Chat. The protocol for the URL that you allowlist must match the URL in the website or Experience site endpoint in the code snippet that’s generated at the end of Embedded Service setup.

![Important](https://sf-zdocs-cdn-prod.zoominsoftware.com/tdta-service-support_legacy-264-0-0-production-enus/081af4ec-6c06-4d4b-9443-cb3516bbc46d/images/icon_important.png)

Important This information applies to Embedded Service only.

1. From Setup, enter CORS in the Quick Find box, then select **CORS**.
2. Select **New**.
3. Enter an origin URL pattern.
    
    The origin URL pattern must include the HTTP or HTTPS protocol and a domain name. The origin URL pattern can include a port. The wildcard character (\*) is supported and must be in front of a second-level domain name. For example, https://\*.example.com adds all subdomains of example.com to the allowlist.
    
    The origin URL pattern can be an IP address. However, an IP address and a domain that resolve to the same address are not the same origin, and you must add them to the CORS allowlist as separate entries.