> For the complete documentation index, see [llms.txt](https://docs.baas.sh/llms.txt). Markdown versions of documentation pages are available by appending `.md` to page URLs; this page is available as [Markdown](https://docs.baas.sh/baas-console/api-settings/domain-protection.md).

# Allowed Domains

Choose which websites can call your API from a browser.

Open **Console → Settings → API Settings → Allowed Domains**, the default tab.

The **Allowed Domains** tab controls which origins a browser may call your API from. One toggle turns protection on, and one list names the origins it allows. In our example, the app is served at `https://app.example.com`, so that origin goes on the list.

## Your API base URL

Copy your project's API URL from the Console's **Dashboard → Project Endpoints**. It is the `url` value the [Quickstart](/baas-sdk/quickstart.md) asks for.

## Inactive is open, active enforces

A new project starts inactive, so the API accepts browser calls from any origin and you can build without configuring anything.

Once active, only the origins on your list may call your API from a browser. Calls that carry no browser origin, like your backend or curl, are not affected.

Switching back to **Inactive** stops the enforcement and keeps your list for the next time you turn it on.

## Turn on and add your origins

{% stepper %}
{% step %}

### Turn protection on

Flip the toggle to **Active**. This unlocks the origin list, which stays locked while protection is off. Your change is saved automatically.
{% endstep %}

{% step %}

### Add each origin

Click the **+** button next to **Allowed Origins** and enter the origin, `https://app.example.com` in our example. Each origin is saved as you add it.
{% endstep %}
{% endstepper %}

{% hint style="warning" %}
**Activate first, then add your origins.** Between the two steps, your app cannot reach the API from a browser, so do them back to back, before your app goes live. The Console keeps working the whole time.
{% endhint %}

If you also sign in from a local dev server while protection is active, add that origin too, with its port.

To remove an origin, use the remove button on its chip and confirm. It loses browser access as soon as the change reaches your API.

## What counts as an origin

Enter each origin on its own, with no path or query string after it. Use `https://`, except for `localhost` and `127.0.0.1`, which accept `http://` too. Matching is exact with no wildcards, so list every origin you serve from in full.

{% hint style="info" %}
**One origin is scheme, host, and port.** `https://app.example.com` and `https://www.app.example.com` are two origins, and a different port makes another.
{% endhint %}

## When changes take effect

A change is saved immediately and reaches every part of your API within 10 minutes. Until then, a removed origin may still be accepted. Users signed in from a removed origin lose access to your API from it. The app side is covered in [Sessions](/baas-sdk/authentication/sessions.md).

## Next

* [Troubleshooting](/baas-sdk/troubleshooting.md): what a missing origin looks like from the app.
* [Sessions](/baas-sdk/authentication/sessions.md): how the SDK keeps a session alive and when it ends.
* [API Settings](/baas-console/api-settings.md): back to the section overview.