This is not the dashboard.

It's an ordinary customer website — a different origin from app.<domain> on purpose. The submission requires a page exactly like this: somewhere the live-chat widget is genuinely installed and testable, not just described.

The install snippet is one script tag, nothing else:

<script src="http://localhost:3001/widget/widget.js"
        data-widget-key="wk_live_4737f088d4a2a9ef588c001f6444b7b8"
        async></script>

Open the chat bubble in the bottom-right corner and send a message — it lands in the workspace's inbox in real time, and a reply from an agent appears back here the same way.

Because this page is served from its own origin, it only works at all if that origin is on the workspace's allowedWidgetOrigins list — the same check a real customer's site would have to pass (docs/09-security.md). Loading this from an unlisted origin is expected to fail closed, not silently degrade.