Organization Owners can choose which domains their published HTML pages can send requests to.
Add a domain
Open Settings → Organization → Security. Under Domain allowlist, enter a
bare domain such as api.example.com and select Add. Do not include
https:// or a page path.
You can add up to 50 entries. Use *.example.com to allow subdomains at any
depth. It does not include example.com; add the apex separately if the page
needs both. You can also add a non-default port, such as
api.example.com:8443.
The list applies to existing and future published HTML pages in the organization, including Public pages. Reload an open page after changing the list.
What the setting allows
The browser can send HTTPS requests to matching domains, including requests
made with fetch and native forms. The entry covers every path on that domain.
It does not add a login, API key, or other credential.
The remote service still decides whether to accept the request. To let page JavaScript read a cross-origin response, the service must also allow the page through its CORS policy. Some requests may require a preflight.
Images, scripts, styles, and fonts follow separate browser rules and may already load from other HTTPS domains without an entry here. Do not put secrets in published HTML or in a hostname.
Remove access
Select Remove next to a domain and confirm. After the change reaches the edge, reload the published page to use the new policy. Removing a domain is not an immediate emergency revocation for pages that are already open.
This Owner security setting is available only in the dashboard. It is not exposed through the CLI or agent tools.