# Browser Settings

Browser Settings control how the Allegro SDK is allowed to talk to the tenant API from a browser. They govern two things:

* **CORS Allowed Origins** — which sites may make cross-origin API requests.
* **Cookie Domain** — how far the SDK's session cookie is shared across your subdomains.

These are organization-wide settings configured under **Organization Settings → Browser** in the Allegro dashboard.

Administrator access required

Browser Settings are managed by an Allegro administrator. If your site cannot reach the API, or you need a session shared across subdomains, ask your administrator to update these values for you.

## CORS Allowed Origins[​](#cors-allowed-origins "Direct link to CORS Allowed Origins")

The browser blocks cross-origin requests unless the API explicitly allows the requesting origin. Every site that embeds the SDK — and therefore calls the tenant API from the browser — must have its origin on the allowed list.

Origins are entered one per line. Two formats are supported:

| Format             | Example                   | Matches                             |
| ------------------ | ------------------------- | ----------------------------------- |
| Exact origin       | `https://app.example.com` | Only that exact scheme, host, port  |
| Subdomain wildcard | `https://*.example.com`   | Any single-level subdomain over TLS |

When the list is left blank, the application defaults apply. A configured [custom domain](/developer/administration/custom-domain.md) is always included automatically, so you do not need to add it here.

Origins also gate return URLs

The allowed-origin list is also used to validate return URLs. The `returnUrl` sent with [magic link](/developer/guides/authentication/magic-links.md) requests and the return URL passed to [checkout](/developer/guides/payment/purchases.md) must resolve to one of these origins, or the request is rejected. This prevents sign-in and purchase tokens from being redirected to domains you do not control.

## Cookie Domain[​](#cookie-domain "Direct link to Cookie Domain")

The SDK stores its session in a cookie. By default that cookie is scoped to the exact hostname that served `client.js`, so a session created on `www.example.com` is not visible on `app.example.com`.

Set a parent domain to share the session across subdomains:

```text
.example.org

```

With `.example.org` configured, a member who signs in on `www.example.org` stays signed in on `app.example.org` and any other `*.example.org` subdomain running the SDK. Leave the field blank to keep the default (current hostname only).

## Related[​](#related "Direct link to Related")

* [Custom Domain](/developer/administration/custom-domain.md) — Serve the SDK from your own domain
* [Script Tag](/developer/guides/script-tag.md) — Embedding the SDK on your site
* [Member Authentication](/developer/guides/authentication.md) — How sessions work