> For the complete documentation index, see [llms.txt](https://docs.baas.sh/llms.txt). Markdown versions of documentation pages are available by appending `.md` to page URLs; this page is available as [Markdown](https://docs.baas.sh/baas-console/api-settings.md).

# API Settings

Configure allowed browser domains and manage server-side API keys.

Open **Console → Settings → API Settings** to configure access to your project's API.

The page has two tabs:

* [**Allowed Domains**](/baas-console/api-settings/domain-protection.md) opens by default. Choose which websites can call your API from a browser.
* [**API Keys**](/baas-console/api-settings/secret-keys.md) holds the secret API keys your backend uses to authenticate requests.

Throughout these pages, an example app at `https://app.example.com` calls the project API at `https://my-project-api.baas.sh`.

## Before you go live

A new project accepts browser calls from any origin. Before you go live, [turn on domain protection](/baas-console/api-settings/domain-protection.md) and list the origins your app is served from.

For the app-side checklist, see [Going to production](/baas-sdk/quickstart.md) in the SDK Quickstart.

{% hint style="info" %}
**Sessions need no setup here.** [Sessions](/baas-sdk/authentication/sessions.md) covers the SDK side.
{% endhint %}

## Next

<table data-view="cards"><thead><tr><th></th><th></th><th data-hidden data-card-target data-type="content-ref"></th></tr></thead><tbody><tr><td><strong>Allowed Domains</strong></td><td>Restrict browser access to the origins your app runs on.</td><td><a href="/baas-console/api-settings/domain-protection.md">Allowed Domains</a></td></tr><tr><td><strong>API Keys</strong></td><td>Create and manage secret API keys for your backend.</td><td><a href="/baas-console/api-settings/secret-keys.md">API Keys</a></td></tr></tbody></table>