Skip to main content

Browser Settings

Browser Settings control how the Allegro SDK is allowed to talk to the tenant API from a browser. They govern two things:

  • CORS Allowed Origins — which sites may make cross-origin API requests.
  • Cookie Domain — how far the SDK's session cookie is shared across your subdomains.

These are organization-wide settings configured under Organization Settings → Browser in the Allegro dashboard.

Administrator access required

Browser Settings are managed by an Allegro administrator. If your site cannot reach the API, or you need a session shared across subdomains, ask your administrator to update these values for you.

CORS Allowed Origins​

The browser blocks cross-origin requests unless the API explicitly allows the requesting origin. Every site that embeds the SDK — and therefore calls the tenant API from the browser — must have its origin on the allowed list.

Origins are entered one per line. Two formats are supported:

FormatExampleMatches
Exact originhttps://app.example.comOnly that exact scheme, host, port
Subdomain wildcardhttps://*.example.comAny single-level subdomain over TLS

When the list is left blank, the application defaults apply. A configured custom domain is always included automatically, so you do not need to add it here.

Origins also gate return URLs

The allowed-origin list is also used to validate return URLs. The returnUrl sent with magic link requests and the return URL passed to checkout must resolve to one of these origins, or the request is rejected. This prevents sign-in and purchase tokens from being redirected to domains you do not control.

The SDK stores its session in a cookie. By default that cookie is scoped to the exact hostname that served client.js, so a session created on www.example.com is not visible on app.example.com.

Set a parent domain to share the session across subdomains:

.example.org

With .example.org configured, a member who signs in on www.example.org stays signed in on app.example.org and any other *.example.org subdomain running the SDK. Leave the field blank to keep the default (current hostname only).