Under the Setting tab, Allowed Domains & IPs restricts which origins can trigger OTPs. OTPs only send when the request comes from an origin on this list.

• The request's Origin host (or, if missing, its Referer host) must exactly match an entry, ignoring case.
• A request whose caller IP address matches an entry is also accepted.
• Add one entry per domain or IP you want to allow, for example app.example.com.

• An empty list blocks every OTP request made from a browser. Add at least your own app's domain before you go live.
• Requests that don't carry an Origin or Referer header, such as calls from a script, are rejected.
• This list applies to browser OTP requests. OTP calls made from your backend with an auth key aren't checked against it.

If OTPs aren't arriving from your widget, check this list first.