What is an origin allow-list?

An origin allow-list is a server-side rule that accepts session data only from requests whose browser-set Origin header matches one of the domains registered for a project.

Why it matters

A recording SDK runs in the browser, so its project key ships in your HTML and anyone can read it. A key that is public cannot be the thing that keeps strangers from writing garbage into your project. Something the page cannot forge has to do that job.

The Origin header is that thing. Browsers set it on cross-site requests and scripts cannot override it, so an ingest service that checks it knows which site a chunk really came from. Combined with rate limits and payload validation, it turns a public key into a safe one.

How AnyReplay handles it

AnyReplay project keys look like ar_pk_live_<24 hex> or ar_pk_test_… and are public by design. The real access control is the server-side Origin allow-list on the ingest service, which a page cannot forge. An app has no web origin, so it is checked against the project's Allowed apps by the bundle id it sends as appId, which filters stray traffic but is not a secret. Ingest also applies rate limits, 120 requests a minute per device, validates every payload and rejects bodies over 512 KB by default. A refused origin or app stops recording at once; a network failure only makes the SDK wait and retry. When you add a new domain or a staging host, add it to the allow-list first. Your Content Security Policy is the mirror image: it says which hosts your page may talk to.