Security

The public key is public

The key that starts with pk_ is like a publishable key. It is safe in page source. It identifies your workspace and only grants access to content you have published. It does not need to change when you add or edit content. Rotate it from Settings → Developers only if you want to retire an embed.

Protect identities

Anyone with your public key can call identify with any user id. Turn on identity verification and sign user ids on your server. Never put the Secret key in client code.

Allowed origins

The allow-list restricts which browsers can use your key. It is not authentication.

Content Security Policy

If your site sends a Content-Security-Policy header, allow:

Directive	Value
script-src	https://app.justonecx.com (script tag install only)
connect-src	https://api.justonecx.com and wss://api.justonecx.com (chat)
script-src (boards)	The same origin also serves justonecx-boards.global.js, loaded the first time a board appears. Set boardsUrl in init() to move it.
style-src	'unsafe-inline', because the SDK injects one <style> element

Without connect-src, every SDK request fails in the browser and the chat shows "Chat is unavailable right now". Nothing reaches our servers, so we cannot see the problem. The SDK logs a hint with your exact API host in the console. See Troubleshooting.

Roadmap and changelog

Public board responses never include emails or full names. Commenters you identified appear as first name and last initial, or "Customer". Private and identified boards are enforced on the server and are never cached. Sign-on links expire in 10 minutes and work once.

What the SDK stores

• A random visitor id in localStorage.
• Small per-visitor flags, for example which content was dismissed.

It sets no cookies. reset() clears the visitor id.

Links in content

Only http and https links are rendered in announcements and other content.

Report a vulnerability

Contact the JustOneCX team privately through your dashboard account. Do not post details publicly.