Allowed Domains
Allowed domains control which origins can submit feedback through the SDK. This is your CORS whitelist — requests from non-listed domains are rejected.
Why it matters
Since the SDK runs in the browser, your API key is visible in network requests. The allowed domains list ensures that only your websites can use the key, preventing unauthorized feedback submissions.
Adding a domain
- Go to Settings → API
- In the Allowed Domains section, enter the domain (e.g.
app.example.com) - Click Add
Domain format
Enter the domain without the protocol or path:
| Valid | Invalid |
|---|---|
app.example.com | https://app.example.com |
localhost | http://localhost:3000 |
staging.example.com | example.com/app |
Removing a domain
Click the remove button next to the domain you want to delete. The change takes effect immediately.
Development
For local development, add localhost to your allowed domains list. Remember to remove it before going to production, or keep it if you want developers to be able to test against the production API.
Next steps
- Generate an API key if you haven’t already
- Install the SDK and start collecting feedback