Origins

allowedOrigins is the CORS allow-list checked on publishable routes, including config fetch and content calls. The draft default is ["*"]. Set your localhost origin and your production origin before you publish a live app. update_comment_draft accepts at most 20 origins.

An allowed origin lets the browser call the API from that site. It does not prove which person is signed in, which tenant they belong to, or which resource they may open. Those checks are the author token and your session. A stolen publishable key on an allowed origin can still only do what the token permits.

Save origins on the draft, then publish. A draft change does not affect clients until publish. See revisions and API keys.