Security
Allowed Domains
Configure domain whitelists, wildcard subdomain rules, port matching, and CORS origin verification.
Overview
The Allowed Domains whitelist is the primary security boundary protecting your public SDK key from unauthorized use on third-party websites.
Whitelist Configuration Rules
- Exact match on scheme, hostname, and port.
- No trailing slashes.
https://mycompany.com
https://www.mycompany.com
https://staging.mycompany.com
http://localhost:3000
Wildcard Subdomains
On Pro and Enterprise plans:
https://*.mycompany.com
https://*-preview.vercel.app
Local Development Whitelisting
Always add your local development server origins (http://localhost:3000, http://localhost:5173) to your Development environment in the Asiyst dashboard.