# Allowed origins

> Which websites may use your live public key.

Source: https://docs.dashfordevs.com/v1/authentication/allowed-origins · Topic: API keys and authentication · Updated: 2026-11-07

A live public key answers only requests whose `Origin` (or `Referer`) is on its list. Manage the list in the dashboard under **Developers → Allowed origins**.

## Patterns

| Pattern | Matches |
| --- | --- |
| `shop.example.com` | exactly that host |
| `*.example.com` | `example.com` and every subdomain |
| `localhost`, `127.0.0.1` | always allowed, no entry needed |

**Enter bare hosts, not URLs.** `shop.example.com` works; `https://shop.example.com` or `shop.example.com/` never matches.

## Server-side requests

Requests from your server (a Next.js server component, for example) have no browser `Origin`. Use the **secret key** there; secret keys skip the origin check. Do not try to fake an origin with a public key: it works until it does not, and the secret key is the right tool.

## Is this security?

The origin check stops other websites from casually using your public key from their visitors' browsers. It is not a lock against a determined script, which is exactly why public keys are read-only.