Allowed origins
Which websites may use your live public key.
1 min readUpdated View as Markdown
On this page
A live public key answers only requests whose Origin (or Referer) is on its list. Manage the list in the dashboard under Developers → Allowed origins.
Patterns
| Pattern | Matches |
|---|---|
shop.example.com |
exactly that host |
*.example.com |
example.com and every subdomain |
localhost, 127.0.0.1 |
always allowed, no entry needed |
Enter bare hosts, not URLs. shop.example.com works; https://shop.example.com or shop.example.com/ never matches.
Server-side requests
Requests from your server (a Next.js server component, for example) have no browser Origin. Use the secret key there; secret keys skip the origin check. Do not try to fake an origin with a public key: it works until it does not, and the secret key is the right tool.
Is this security?
The origin check stops other websites from casually using your public key from their visitors' browsers. It is not a lock against a determined script, which is exactly why public keys are read-only.
Keep reading
Something wrong or missing on this page? Email support@dashfordevs.com.