CORS & domain allowlist

Cerrtify enforces a per-organisation domain allowlist on browser-originated requests. Calls whose Origin (or Referer) hostname isn't on your list are rejected with 403 origin_not_allowed.

Configure allowed domains

In the dashboard, add the domains you'll call from:

• app.example.com
• staging.app.example.com

Matching is by hostname — scheme and port don't matter. Each entry can optionally allow subdomains, so example.com with subdomains enabled covers app.example.com too. Changes take effect within seconds.

In sandbox, localhost and 127.0.0.1 are always allowed — no entry needed for local development.

Browser callers must still authenticate

The domain check is in addition to the X-API-Key header. Don't ship secret keys to browsers — proxy through your backend, or issue short-lived browser tokens scoped to a single user session.

Server-to-server calls

If your caller is a server (not a browser), this check doesn't apply. The allowlist is only enforced when an Origin or Referer header is present.