Widget key and allowed domains
The wgt_ key followed by 32 hexadecimal characters is public; protection comes from allowing every domain that may load the widget.
A public key, not a secret
The key format is wgt_ plus 32 lowercase hexadecimal characters. It identifies the browser widget and can appear in public HTML. tenantId is internal and must not be used for installation. widgetId and siteId are not part of this flow.
Allow every origin
Allowed domains are required. Add production, staging, and every preview domain that must work. Disabling the widget removes its key; enabling it again creates another key that you must place in the installation.