Website Settings

Configure domain whitelists, CORS headers, wildcard subdomain matching, and CSP directives.

Overview

Website Settings define the network security perimeter for your Asiyst project. By strictly whitelisting authorized origins, you prevent third parties from stealing your project keys and consuming your AI quota.

Allowed Domains Whitelist

In Project > Settings > Allowed Domains, specify all domains authorized to run the SDK:

https://mycompany.com https://www.mycompany.com https://app.mycompany.com https://staging.mycompany.com http://localhost:3000

http://127.0.0.1:5173

Strict Formatting Rules:

Include the protocol (https:// or http://).

Do not add trailing slashes (use https://example.com, not https://example.com/).

Specify non-standard ports if used locally (e.g. http://localhost:8080).

Wildcard Subdomain Matching

On Pro and Enterprise plans, wildcard subdomains are supported:

https://*.mycompany.com

https://*-preview.vercel.app

CORS & HTTP Headers Configuration

When the SDK connects, the Asiyst Gateway evaluates the Origin and Referer HTTP headers against your allowed domain list. If valid, the gateway issues an ephemeral 24-hour JWT token.

Troubleshooting Domain Rejections

If DevTools logs 403 Forbidden: Origin not allowed:

Check the exact URL shown in the browser address bar.

Confirm the scheme matches (http vs https).

Add the domain to the active environment in the dashboard.

Docs/Configuration

Configuration