Widget not showing

Confirm the script URL is https://canwechat.dev/api/widget.js and data-site matches your public key. Check the browser network tab for blocked scripts or CSP. Ensure the plan is trial or Pro — inactive plans hide the widget. Hard-refresh after changing domains.

Origin denied

Allowed domains must include the exact hostname visitors use (including www vs apex). Localhost needs an explicit allow if you locked production domains. Empty allow-lists are unrestricted; once you add any domain, everything else is denied.

Messages not reaching Slack

Confirm Slack is the active reply channel. Bot must be in the channel; private channels require an invite. Signing secret must match the Slack app. Check Integrations health and queue retries. Reply in the thread CanWeChat created — top-level channel messages are ignored.

Discord interactions

Interactions URL must point at the CanWeChat Discord interactions endpoint from the dashboard. Public key, application ID, and bot token must match the same Discord application. Grant Send Messages, Create Public Threads, and Use Slash Commands. Run /reply in a test thread after connect.

Telegram secret mismatch

Webhook secret registered with Telegram must match what CanWeChat stored. Re-save the bot token from Integrations to rotate cleanly. Confirm the bot can message the target chat/group.

Webhook 401s

Verify HMAC-SHA256 over `${timestamp}.${rawBody}` with the current relay secret. Reject stale timestamps. Do not parse JSON before computing the signature. Rotate secret only after updating your receiver.