Domain allowlist

Each workspace carries a domain allowlist. When it is set, the API rejects embed requests coming from any origin that is not on the list — so a copied embed snippet will not run on someone else’s site.

How it works

1. The embed reports the host page’s origin with each viewer request.
2. The API checks it against the workspace allowlist.
3. Origins not on the list receive HTTP 403 with the error code EMBED_DOMAIN_NOT_ALLOWED, and the embed stays empty.

Rules

• Configure it to close the embed. Until the list has an entry, the embed runs on any site.
• Wildcards are supported: *.example.com matches every subdomain of example.com — but not the bare example.com itself. If you serve the apex domain too, list it as its own entry.
• First-party is always allowed. Togenar’s own share links, launcher pages and the panel preview keep working regardless of the list.

It also unlocks the AR hand-off

The same list decides whether AR may hand a shopper back to your site: the product-page URL the embed carries into a QR/AR hop (page-url) is honoured only when its host is on the allowlist.

Here the empty list means the opposite of the rule above — empty = hand-off off, and the AR banner falls back to Togenar’s own viewer page:

	Empty allowlist	Configured allowlist
Embed on other domains	allowed	blocked
AR return to your page	off	allowed for listed domains

The asymmetry is deliberate: a return address is only honoured when it was registered in advance.

Prefer exact hosts over wildcards here — a wildcard makes every current and future subdomain a valid return address.

Set it up

Send the domains your embed is allowed to run on and Togenar configures the allowlist for your workspace — open a ticket. One entry per domain, wildcards included:

shop.example.com
*.example.de

Up to 20 entries per workspace. A change takes effect on the next viewer load: no redeploy of your site, no edit to the snippet you already shipped.

Worth listing up front: your production storefront, its www variant if you serve one, and your staging domain — a locked-out staging environment is the most common way this setting surprises a team mid-integration.

Troubleshooting

The embed renders an empty frame and the network tab shows a 403 with EMBED_DOMAIN_NOT_ALLOWED? The page’s host is missing from the allowlist. Remember that www.example.com and example.com are different hosts: *.example.com covers the www form and every other subdomain, but the bare example.com still needs its own entry.