SDK/GUIDES
Security and domains
How the SDK keeps your workspace safe when the keys live in browser code.
On this page
- The client ID is public. Like a publishable key, it’s safe to ship in frontend code.
- Domains are checked. Every request sends your client ID and the page’s Origin. The server rejects origins you haven’t approved.
- No user secrets. The SDK never handles your users’ passwords or tokens.
Approve your domains #
1
Open Dashboard › Developer › DomainsAdd each domain your app runs on, including staging and preview domains.
2
Verify itProve you own it with a DNS TXT record or a file.
3
Wait for approvalRequests from that domain work once it’s approved.
If the button never becomes ready, check that the current domain is approved for your client ID.
Was this page helpful? @edithpro/sdk 1.0.5 · Edit this page