---
title: Domain allowlist
description: Choose which domains published HTML pages can send requests to.
slug: /docs/domain-allowlist
group: organization
updatedAt: 2026-09-17
---

Organization Owners can choose which domains their published HTML pages can
send requests to.

## Add a domain

Open **Settings → Organization → Security**. Under **Domain allowlist**, enter a
bare domain such as `api.example.com` and select **Add**. Do not include
`https://` or a page path.

You can add up to 50 entries. Use `*.example.com` to allow subdomains at any
depth. It does not include `example.com`; add the apex separately if the page
needs both. You can also add a non-default port, such as
`api.example.com:8443`.

The list applies to existing and future published HTML pages in the
organization, including Public pages. Reload an open page after changing the
list.

## What the setting allows

The browser can send HTTPS requests to matching domains, including requests
made with `fetch` and native forms. The entry covers every path on that domain.
It does not add a login, API key, or other credential.

The remote service still decides whether to accept the request. To let page
JavaScript read a cross-origin response, the service must also allow the page
through its CORS policy. Some requests may require a preflight.

Images, scripts, styles, and fonts follow separate browser rules and may already
load from other HTTPS domains without an entry here. Do not put secrets in
published HTML or in a hostname.

## Remove access

Select **Remove** next to a domain and confirm. After the change reaches the
edge, reload the published page to use the new policy. Removing a domain is not
an immediate emergency revocation for pages that are already open.

This Owner security setting is available only in the dashboard. It is not
exposed through the CLI or agent tools.