A project’s Settings tab has four pages: General, Allowed sites, Build secret and, for owners, Delete project. Owners and admins can change them; everyone else on the project sees them read-only.
Allow your preview's address
In Allowed sites, type the exact address the widget runs on, like
https://preview.example.com, and press Add. Comments from any other address are refused. Remove takes an address off the list.Reveal, copy or rotate the secret
Build secret shows the line a preview build needs,
FEEDBACK_SECRET=…, hidden. The icons beside it reveal it, copy the whole line, and rotate it. Rotating asks first; once you confirm, the new secret is shown.
General
Name is what the project is called for everyone on it. Picture is shown on the project’s card for everyone on it: click it to choose a PNG, JPEG or WebP file, resized for you. Remove picture brings back the tint and initial.
Allowed sites
Add the address of every place the widget should accept comments from: your preview and, if reviewers comment there, your live site. Use one that stays the same between deploys, like your preview branch’s URL: a per-deployment URL changes on every push.
Review links also allow their own address, so you do not need to add it. While the list is empty, the page reminds you to add your preview’s address. See Share a preview.
Build secret
The secret is what turns a preview build into one that can take comments. Set it as FEEDBACK_SECRET in your host’s environment, for preview builds only. You can come back for it here at any time. Treat it like a deploy key: anyone holding it can see which file and line of your source each comment points at.
Only owners and admins can reveal, copy or rotate it.
Settings shows no project id and no API address: a preview build needs only the secret. Where a step needs the project id, like the script tag or feedback link, the Setup tab fills it in.
Delete a project
Only an owner sees Delete project. It removes the project, its comments and everyone’s replies, for everyone on it, and anyone connected to it can no longer sync. It cannot be undone, so the dashboard asks you to type the project’s name to confirm.
The Setup tab
Setup, the last tab, connects the project as a checklist, filled in with its own values. Pick your framework at the top; the steps follow it:
- Install the package,
@ontrackd/feedback, as a dev dependency. - Add it to your build, with your framework’s config.
- Set the preview build’s environment: the build secret, with the same reveal, copy and rotate as in Settings.
- Allow the preview’s address: the same list as Allowed sites.
- Leave the first comment. The step waits, and ticks itself when the first comment arrives.
For a site without a build, Any website (script tag) replaces the first three steps with one: paste the script, with the project id in it, in your site’s head.
Under the steps are what comes next: invite reviewers with a review link, bring comments to your machine with feedback link, and connect your agent. See the Quickstart for the whole setup, step by step.