Skip to content
gutternote

Sites and access

All of these settings are on a project’s Configure page.

Sites that can use the widget

Only sites on this list can load the widget for the project. Add each address with Add address, or use Edit addresses in bulk for one per line. Then select Save websites.

Each address needs the scheme and, if your site uses one, the port. Leave out the path:

https://preview.acme.com
https://pr-*.dev.acme.com
http://localhost:3000

A * matches inside one part of the hostname. It never crosses a dot:

PatternMatchesDoes not match
https://pr-*.dev.acme.comhttps://pr-42.dev.acme.comhttps://pr-42.other.acme.com
https://*.staging.acme.comhttps://shop.staging.acme.comhttps://a.shop.staging.acme.com

Don’t use broad patterns such as https://*.vercel.app. They let in sites other people own. Keep a part of the hostname that belongs to you, such as https://*-acme.vercel.app.

An empty list blocks every site.

Sign-in across previews

When a wildcard covers sibling hosts, such as https://pr-*.dev.acme.com, a reviewer who signs in on one preview stays signed in on the others. This doesn’t work on a shared public domain such as vercel.app. There, each preview keeps its own sign-in.

Commenter session length sets how long a commenter stays signed in, from 1 to 720 hours. The default is 7 days.

Who can comment

Pick an option under Who may comment, then select Save who may comment.

SettingWho can comment
AnyoneAnyone who can open the page, under a name they choose. The default.
Google sign-inAnyone with a Google account.
Google, named domains onlyGoogle accounts from domains you list, such as acme.com, and members of your workspace whatever their address. It also permits opted-in Slack replies whose Slack-confirmed email is on a listed domain; those authors are labeled as a Slack-domain identity, not a Gutternote account or member.
Your own identity providerPeople your own app signs in. Needs the Bikeshed plan. See Identity tokens.

The Slack exception applies only to new replies imported from a connected Slack workspace, on a project where a workspace owner has saved reply importing on. A confirmed Slack email does not create a Gutternote account, workspace membership, seat, session or permission to start agent work.

Commenters never use a seat. Only workspace members can resolve, reopen or send notes to an agent. With your own identity provider, a member gets those controls only when the token sets email_verified. See Member access.

Whose notes reach an agent

  • Notes from workspace members reach a connected agent straight away.
  • Notes from anyone else wait. A member opens the note and selects Send to agent.

Who may tag an agent narrows which members count. See Set up agents.

If a site is refused or sign-in doesn’t carry over

If the widget doesn’t load, run location.origin in the browser console on that page. Compare the result with the list under Configure → Sites that can use the widget. Check the scheme, the port and every part of the hostname.

If reviewers must sign in again on each preview:

  • Check that both previews use the same project key.
  • Check that the addresses are covered by one wildcard on a domain you own, not by exact addresses or a public domain such as vercel.app.
  • Use the same browser profile. Private windows don’t share sign-in.