Origins

Browser calls to the Importer API are subject to CORS. The service uses the CORS_ORIGINS setting (comma-separated origins, or * for open development). Production deployments should list the exact origins of customer apps that embed the component in hosted mode.

This is not a substitute for keeping secret keys off the client. It limits which browser origins can call the public API endpoints from a web page.

Related: API keys · React component