Domains
Whitelist the domains your integration will send requests from.
Domains
Production API keys check that requests come from a domain you have approved. This prevents your key from being used on domains you do not control.
Manage your domains at Account → Domains.
Adding a domain
- Go to Account → Domains
- Enter your domain — see the format examples below
- Click Add domain
The domain is active immediately.
Domain format
Enter the bare hostname only — no protocol, no path, no trailing slash.
| ✅ Correct | ❌ Wrong | Why it's wrong |
|---|---|---|
myshop.dk | https://myshop.dk | Remove the https:// prefix |
myshop.dk | http://myshop.dk | Remove the http:// prefix |
myshop.dk | myshop.dk/ | Remove the trailing slash |
myshop.dk | www.myshop.dk | Only if you use www. — add both if needed |
www.myshop.dk | myshop.dk | www. and non-www. are treated as different domains |
staging.myshop.dk | myshop.dk | Subdomains are not automatically included |
myshop.dk | myshop.dk/checkout | No paths — the whole domain is whitelisted |
Common setups
Standard webshop — add both with and without www if you use both:
myshop.dk
www.myshop.dkWith a staging environment:
myshop.dk
www.myshop.dk
staging.myshop.dkShopify store on a custom domain:
myshop.dk
www.myshop.dkWooCommerce on a subdirectory (e.g. myshop.dk/shop):
myshop.dkThe subdirectory /shop does not need to be listed — the whole domain is whitelisted automatically.
What counts as a match
The domain is checked against the Origin header of incoming requests. This header is automatically set by browsers and most HTTP clients.
You should add every domain your integration runs on, including:
- Your live store (
myshop.dk) - A staging environment (
staging.myshop.dk) - Any subdomain that initiates verifications
All keys
Domain whitelisting is enforced for both test (pk_test_) and production (pk_live_) keys. Add your domain before testing, including any staging or local development environments you use.