Not at all, it just means that instead of implementing SSO I built a fully embeddable widget.
You can call the widget from anywhere in the world, well of course, that’s the point of a widget.
When you say do whatever you want. What do you want to do more than what a widget exposes? Of course you can call the endpoints and what not, they are allowing CORS.
If you’re talking about simulating fake like and what not, just like Feature Upvote there’s throttling and filtering etc.
Not sure what you’re referring to. Happy to discuss how I implemented this if you have more questions. The goal of a widget, like Intercom’s for example is to be “public”.
Our users can wildcard domain that can embed the widget, of course.
Hope that answer the question.