Add a domain to your Allowed Origins

Setup Web app origin allowlist · ~20 seconds · ~2 min read · Updated August 4, 2026

Crossdeck locks your web app's Allowed Origins to the first domain it sees on its first heartbeat. That's a security control: a leaked publishable key can't be used from any other site. So when you move to — or add — a custom domain, you add it yourself. It takes about 20 seconds.

Shared reference.

Every Crossdeck connector links here from its “custom domain” note — the steps below are the same whether you arrived from Webflow, Bubble, WordPress, or a hand-rolled site.

Why it's locked to the first domain

A publishable key lives in your page's client-side code, so anyone can read it. On its own that would let a copied key drive events from any site. Allowed Origins closes that gap: Crossdeck pins the key to the first origin it sees a real heartbeat from, and rejects requests whose Origin header isn't on the list. The lock is automatic and needs no setup — the only time you touch it is when a legitimate new origin (your custom domain, an apex/www pair, a staging host) needs to be allowed too.

Add a domain — step by step

Sign in to the Crossdeck dashboard → app.cross-deck.com.
Top-left, make sure the project switcher shows the project you're adding the domain to.
Bottom-left, click Developers to open the Developer Workbench.
Click the Apps tab.
Find your Web app card. Under Allowed origins you'll see the domains currently locked in (e.g. https://your-site.webflow.io).
In the empty field (placeholder https://www.example.com), type your new domain as a full origin:
- include the scheme: https://yourbrand.com
- exact match — scheme + host (+ port if non-standard)
- no path, no trailing slash, no wildcards (https://yourbrand.com, not https://yourbrand.com/ or https://*.yourbrand.com)
Click Add origin. It's live immediately.
Serving both apex and www? Add both: https://yourbrand.com and https://www.yourbrand.com.

Add it before you cut over.

If you point your custom domain live before adding it here, requests from it are rejected until you do — so add the origin first, then flip the domain.

Good to know

Requests whose Origin header isn't on the list are rejected with origin_not_allowed.
Matching is case-sensitive and exact — https://APP.example.com ≠ https://app.example.com, and https://example.com ≠ https://example.com:3000.
Remove a domain any time with the × on its chip.
Native (iOS/Android) keys ignore this list — there's no browser Origin on a native client.

What's next

API keys & authentication — publishable vs secret keys, and why the publishable key is safe to ship in client code.
Web SDK quickstart — put @cross-deck/web on your pages and fire the first heartbeat.
Crossdeck for Webflow — the connector that most often brings you here, when you swap the *.webflow.io address for a custom domain.
Create a project — where your web app and its keys are registered.

Allowed Origins — first-heartbeat origin lock with self-service add for custom domains. Full origin, exact + case-sensitive match, no path or wildcards; rejected requests return origin_not_allowed; native keys are exempt (August 4, 2026). Related: API keys & authentication, Crossdeck for Webflow.

Using an AI assistant? Read this page as clean markdown — index.md — or the whole docs index at /docs/llms.txt.