# Add a domain to your Allowed Origins > Source: https://cross-deck.com/docs/allowed-origins/ · Crossdeck developer docs (generated from the published page). Setup Web app origin allowlist · ~20 seconds · ~2 min read · Updated August 4, 2026 Crossdeck locks your web app's **Allowed Origins** to the **first domain it sees** on its first heartbeat. That's a security control: a leaked publishable key can't be used from any other site. So when you move to — or add — a **custom domain**, you add it yourself. It takes about 20 seconds. Shared reference. Every Crossdeck connector links here from its “custom domain” note — the steps below are the same whether you arrived from Webflow, Bubble, WordPress, or a hand-rolled site. ## Why it's locked to the first domain A publishable key lives in your page's client-side code, so anyone can read it. On its own that would let a copied key drive events from any site. Allowed Origins closes that gap: Crossdeck pins the key to the **first origin it sees a real heartbeat from**, and rejects requests whose `Origin` header isn't on the list. The lock is automatic and needs no setup — the only time you touch it is when a *legitimate* new origin (your custom domain, an apex/`www` pair, a staging host) needs to be allowed too. ## Add a domain — step by step - Sign in to the **Crossdeck dashboard** → [app.cross-deck.com](https://app.cross-deck.com). - Top-left, make sure the **project switcher** shows the project you're adding the domain to. - Bottom-left, click **Developers** to open the **Developer Workbench**. - Click the **Apps** tab. - Find your **Web** app card. Under **Allowed origins** you'll see the domains currently locked in (e.g. `https://your-site.webflow.io`). - In the empty field (placeholder `https://www.example.com`), type your new domain as a **full origin**: include the scheme: `https://yourbrand.com` - **exact match** — scheme + host (+ port if non-standard) - **no path, no trailing slash, no wildcards** (`https://yourbrand.com`, not `https://yourbrand.com/` or `https://*.yourbrand.com`) - Click **Add origin**. It's live immediately. - Serving both apex and `www`? Add **both**: `https://yourbrand.com` **and** `https://www.yourbrand.com`. Add it before you cut over. If you point your custom domain live *before* adding it here, requests from it are rejected until you do — so add the origin first, then flip the domain. ## Good to know - Requests whose `Origin` header isn't on the list are rejected with `origin_not_allowed`. - Matching is **case-sensitive** and exact — `https://APP.example.com` ≠ `https://app.example.com`, and `https://example.com` ≠ `https://example.com:3000`. - Remove a domain any time with the **×** on its chip. - Native (iOS/Android) keys ignore this list — there's no browser `Origin` on a native client. ## What's next - [API keys & authentication](https://cross-deck.com/docs/api-keys/index.html) — publishable vs secret keys, and why the publishable key is safe to ship in client code. - [Web SDK quickstart](https://cross-deck.com/docs/quickstart-web/index.html) — put `@cross-deck/web` on your pages and fire the first heartbeat. - [Crossdeck for Webflow](https://cross-deck.com/docs/webflow/index.html) — the connector that most often brings you here, when you swap the `*.webflow.io` address for a custom domain. - [Create a project](https://cross-deck.com/docs/create-a-project/index.html) — where your web app and its keys are registered. Allowed Origins — first-heartbeat origin lock with self-service add for custom domains. Full origin, exact + case-sensitive match, no path or wildcards; rejected requests return `origin_not_allowed`; native keys are exempt (August 4, 2026). Related: [API keys & authentication](https://cross-deck.com/docs/api-keys/index.html), [Crossdeck for Webflow](https://cross-deck.com/docs/webflow/index.html).