Domain whitelist

Restrict your API key so it only works on domains you control. This limits exposure if your key is ever scraped from your front-end code.

How to configure

There are exactly two rules:

Entry	Matches
`kookai.fr`	`kookai.fr` exactly, plus any subdomain (`www.kookai.fr`, `shop.kookai.fr`, etc.)
`staging.kookai.fr`	`staging.kookai.fr` exactly, plus its subdomains

No regex, no wildcard syntax — entering kookai.fr is enough to cover your entire domain and all its subdomains.

Widget requests include an Origin header automatically (set by the browser)
Direct API calls must include an Origin header manually when restrictions are active
Requests from non-whitelisted origins receive 403 Domain not authorized

Server-side calls don’t have a browser Origin. Two options:

Remove domain restrictions for keys used exclusively server-side
Add your server’s domain to the whitelist and send it as the Origin header

curl -X POST "https://..." \
  -H "X-API-Key: wearo_xxx" \
  -H "Origin: https://api.mystore.com" \
  ...