Allowed URLs

Allowed URLs restrict a Key to a list of web addresses. We match the Referer and Origin headers of an incoming HTTP request against your list. If no match is found, the API returns a 4011 reply. If a match is found the request proceeds as normal, and the Access-Control-Allow-Origin response header is set to the requester's Origin.

Each Key can be restricted against a number of URLs. Individual Licensee Keys can also have allowed URLs assigned to them.

When to use Allowed URLs

Browser-based widgets only. Address Finder, Postcode Lookup and Address Lookup run in the browser and call our API directly from client code. Their API keys are visible to anyone viewing your site. Allowed URLs is the security boundary that prevents key reuse from other origins.

Backend integrations do not need Allowed URLs. Server-to-server API calls (cleanse, find, lookup) originate from your backend, not the browser. Restrict access via authentication (API key + user token) and your server's own network security. Enabling Allowed URLs on a backend-only key may block legitimate requests from cloud infrastructure (e.g. Vercel Functions, AWS Lambda) or complicate deployments.

Allowed URL Rules

How a URL is matched depends on how you write it.

URL format	What it matches	Example
*.domain.com	The parent domain and any subdomain. Do not include a path or protocol in this format	*.domain.com matches domain.com, www.domain.com and account.domain.com
Begins http:// or https://	Any URL that starts with the string	https://www.example.com matches https://www.example.com/ and https://www.example.com/signup
Anything else	Any URL that contains the string	.example.com/signup matches https://www.example.com/signup and https://app.example.com/signup

Substring matching ignores the protocol, so a bare foo.com matches https://bar.foo.com as well as http://bar.foo.com.

We strongly recommend restricting by domain and protocol only, for example https://www.example.com. Browsers are deploying increasingly strict defaults when it comes to returning path information on the referer header.

How the headers behave

Matching depends on headers the browser controls, so two things are worth knowing before you add a path to your list.

• Referrer policy. The referrer policy of your page affects whether we can check the Referer header. If Referrer-Policy is enabled, no Referer headers are sent for no-referrer and same-origin.
• The Origin header carries no path. If you are relying on Origin matching and want to match the domain and protocol, for example https://example.com, omit the trailing slash and any path. The Origin header omits that information too.

Enabling Allowed URLs also enables CORS.

Related guides

• API Key Security: choose the right controls for a frontend or backend integration
• API Key Settings: daily and individual lookup limits alongside Allowed URLs
• API Key: where to find your Key and what each Key controls