--- title: "Security" slug: "chatbot-security" description: "Implement JWT for the Eddy AI Chatbot to secure your projects, ensuring trusted authentication and protecting sensitive information from unauthorized access." updated: 2026-07-06T07:25:56Z published: 2026-07-06T07:25:56Z canonical: "docs.document360.com/chatbot-security" --- > ## Documentation Index > Fetch the complete documentation index at: https://docs.document360.com/llms.txt > Use this file to discover all available pages before exploring further. # Security Security settings in Eddy AI Chatbot let you control where your chatbot can be embedded and configure secure user authentication using JSON Web Tokens (JWT). You can restrict the chatbot to specific trusted domains to prevent it from appearing on unauthorised sites, and enable JWT authentication to ensure only verified users can interact with the chatbot. Both settings are available under the **Security** () tab in your chatbot's configuration panel. --- ## When to configure security settings - Use **Trusted domains** when you want to restrict the chatbot to specific websites and prevent it from loading on domains you have not authorised. - Use **Connected domains** to audit where your chatbot embed code has been detected across the web. - Use **JWT authentication** when your chatbot is deployed on a private or authenticated site and you need to verify the identity of users before they can interact with the chatbot. --- ## Before you begin - You must have [created an Eddy AI Chatbot](https://docs.document360.com/docs/create-chatbot) and [embedded it on your site](https://docs.document360.com/docs/chatbot-embed-code). - To configure JWT, have your **Client ID**, **Client secret**, **Chatbot ID**, and **Token endpoint** details ready. --- ## Configure trusted domains Trusted domains define which websites are authorised to display your chatbot. Any domain not on the list will not load the chatbot, even if the embed code is present. 1. Navigate to **AI Chatbot** (![Frame image](https://cdn.document360.io/860f9f88-412e-4570-8222-d5bf2f4b7dd1/Images/Documentation/Frame%201707479697.png)) in the left navigation bar and click **Customize**. 2. Navigate to the **Security** () tab. ![Settings page for managing chatbot security, including trusted and connected domains.](https://cdn.document360.io/860f9f88-412e-4570-8222-d5bf2f4b7dd1/Images/Documentation/image-1769525947780.png) 1. Click **+ Add** under **Trusted domains**. ![Trusted domains configuration panel showing the domain entry field.](https://cdn.document360.io/860f9f88-412e-4570-8222-d5bf2f4b7dd1/Images/Documentation/Trusted%20Domains.png) 1. Enter the domain where your chatbot will be embedded. 2. Click **Save** to apply. NOTE Only domains listed in Trusted domains are authorised to display the chatbot on your frontend application. If no trusted domains are added, the chatbot will work on any domain. The domain is now authorised and the chatbot will load on that site. --- ## View connected domains Connected domains shows you an auto-populated, read-only list of all domains where your chatbot embed code has been detected. Use this to audit where the chatbot is currently active. 1. Navigate to the **Security** () tab. 2. Click **Connected domains** to view the list. ![Connected domains screen showing the auto-populated list of domains where the chatbot embed code has been detected.](https://cdn.document360.io/860f9f88-412e-4570-8222-d5bf2f4b7dd1/Images/Documentation/Connected%20domains%281%29.png) NOTE Connected domains is an auto-populated, read-only section. It reflects the domains where the chatbot embed code has been detected — not necessarily where the chatbot is visible to users. If the embed code is detected on a domain that is not in your Trusted domains list, a warning is displayed and the chatbot will not be visible on that domain. To resolve this, add the domain to the Trusted domains list. --- ## Configure JWT authentication JWT (JSON Web Token) enables secure chatbot authentication, ensuring only verified users on your site can interact with the chatbot. 1. Navigate to the **Security** () tab. 2. Enable **JWT** and configure the following fields: | Field | Description | | --- | --- | | **Client ID** | The unique identifier for your client application | | **Chatbot ID** | The unique identifier for your chatbot | | **Token endpoint** | The URL your server uses to generate and return JWT tokens | | **Client secret** | The secret key used to sign and verify JWT tokens | 1. Configure your **Authorization URLs**. 2. Click **Save** to apply changes. ![JWT configuration screen showing Client ID, Chatbot ID, token endpoint, client secret, and authorization URL fields.](https://cdn.document360.io/860f9f88-412e-4570-8222-d5bf2f4b7dd1/Images/Documentation/JWT-%20Eddy%20AI%20Chatbot.png) The chatbot now requires JWT verification before users can interact with it. --- ## Best practices - **Always configure trusted domains before going live** — leaving trusted domains empty means the chatbot can load on any domain, including sites you do not control. - **Add all your environments as trusted domains** — include your production, staging, and development domains so the chatbot works correctly across all environments without unexpected blocks. - **Use JWT for authenticated knowledge bases** — if your knowledge base or website requires users to log in, enable JWT so the chatbot session is tied to the authenticated user identity. - **Rotate your Client secret periodically** — treat the Client secret like a password. Rotate it on a regular schedule and update the Token endpoint configuration accordingly. - **Use Connected domains to detect unauthorised usage** — if you see an unrecognised domain in the Connected domains list, restrict access immediately by adding only your authorised domains to the Trusted domains list.