{"id":28988,"date":"2026-09-03T14:15:30","date_gmt":"2026-09-03T14:15:30","guid":{"rendered":"https:\/\/refiner.io\/docs\/?post_type=knowledgebase&#038;p=28988"},"modified":"2026-09-03T16:06:00","modified_gmt":"2026-09-03T16:06:00","slug":"trusted-domains","status":"publish","type":"knowledgebase","link":"https:\/\/refiner.io\/docs\/kb\/javascript-client\/trusted-domains\/","title":{"rendered":"Trusted Domains"},"content":{"rendered":"\n\n\n<h2 class=\"wp-block-heading\">Introduction<\/h2>\n\n\n\n<p>Trusted Domains lets you restrict JavaScript SDK traffic to a defined list of domains.<\/p>\n\n\n\n<p>Your Refiner Environment ID is included in your frontend JavaScript code and can therefore be discovered by third parties. By configuring Trusted Domains, you can prevent other websites from simply reusing your Environment ID to send JavaScript SDK traffic to your Refiner environment.<\/p>\n\n\n\n<p>We recommend configuring Trusted Domains for production environments.<\/p>\n\n\n\n<h2 class=\"wp-block-heading\">Configure Trusted Domains<\/h2>\n\n\n\n<p>Go to <strong>Settings &gt; SDK Security &gt; Trusted Domains<\/strong> and add the domains from which your Refiner JavaScript SDK is allowed to send requests.<\/p>\n\n\n<div class=\"wp-block-image\">\n<figure class=\"aligncenter size-large\"><img loading=\"lazy\" decoding=\"async\" width=\"1024\" height=\"464\" src=\"https:\/\/refiner.io\/docs\/wp-content\/uploads\/2026\/09\/Screenshot-2026-09-03-at-18.05.07-1024x464.png\" alt=\"\" class=\"wp-image-28994\" srcset=\"https:\/\/refiner.io\/docs\/wp-content\/uploads\/2026\/09\/Screenshot-2026-09-03-at-18.05.07-1024x464.png 1024w, https:\/\/refiner.io\/docs\/wp-content\/uploads\/2026\/09\/Screenshot-2026-09-03-at-18.05.07-800x363.png 800w, https:\/\/refiner.io\/docs\/wp-content\/uploads\/2026\/09\/Screenshot-2026-09-03-at-18.05.07-768x348.png 768w, https:\/\/refiner.io\/docs\/wp-content\/uploads\/2026\/09\/Screenshot-2026-09-03-at-18.05.07-1536x696.png 1536w, https:\/\/refiner.io\/docs\/wp-content\/uploads\/2026\/09\/Screenshot-2026-09-03-at-18.05.07.png 1708w\" sizes=\"auto, (max-width: 1024px) 100vw, 1024px\" \/><\/figure><\/div>\n\n\n<p>Enter fully qualified domain names, for example:<\/p>\n\n\n\n<pre class=\"EnlighterJSRAW\" data-enlighter-language=\"generic\" data-enlighter-theme=\"\" data-enlighter-highlight=\"\" data-enlighter-linenumbers=\"\" data-enlighter-lineoffset=\"\" data-enlighter-title=\"\" data-enlighter-group=\"\">app.myapp.com<\/pre>\n\n\n\n<p>You can also use a wildcard to allow all subdomains:<\/p>\n\n\n\n<pre class=\"EnlighterJSRAW\" data-enlighter-language=\"generic\" data-enlighter-theme=\"\" data-enlighter-highlight=\"\" data-enlighter-linenumbers=\"\" data-enlighter-lineoffset=\"\" data-enlighter-title=\"\" data-enlighter-group=\"\">*.myapp.com<\/pre>\n\n\n\n<p>Leave the list empty if you want to accept JavaScript SDK traffic from any domain.<\/p>\n\n\n\n<h2 class=\"wp-block-heading\">Security considerations<\/h2>\n\n\n\n<p>Trusted Domains provides a useful barrier against unauthorized use of your Environment ID, but it should not be considered a complete security mechanism.<\/p>\n\n\n\n<p>Domain checks rely on information included with incoming browser requests. While this prevents straightforward misuse from other websites, a determined attacker can still construct requests manually and spoof or manipulate request metadata.<\/p>\n\n\n\n<p>Trusted Domains should therefore be considered an additional layer of protection rather than a way to authenticate individual users.<\/p>\n\n\n\n<p>For applications where users are identified, we also recommend enabling <a href=\"https:\/\/refiner.io\/docs\/kb\/settings\/identity-verification\/\">Identity Verification<\/a>. Identity Verification cryptographically verifies individual users and provides stronger protection against user impersonation and bogus user profiles.<\/p>\n","protected":false},"excerpt":{"rendered":"<p>Introduction Trusted Domains lets you restrict JavaScript SDK traffic to a defined list of domains. Your Refiner Environment ID is included in your frontend JavaScript code and can therefore be discovered by third parties. By configuring Trusted Domains, you can prevent other websites from simply reusing your Environment ID to send JavaScript SDK traffic to [&#8230;]<\/p>\n<p><a class=\"btn btn-secondary understrap-read-more-link\" href=\"https:\/\/refiner.io\/docs\/kb\/javascript-client\/trusted-domains\/\">Read More&#8230;<\/a><\/p>\n","protected":false},"author":1,"featured_media":0,"comment_status":"closed","ping_status":"open","template":"","knowledgebase_tag":[],"class_list":["post-28988","knowledgebase","type-knowledgebase","status-publish","hentry","knowledgebase_cat-javascript-client"],"acf":[],"featured_image_urls_v2":{"full":"","thumbnail":"","medium":"","medium_large":"","large":"","1536x1536":"","2048x2048":"","ab-block-post-grid-landscape":"","ab-block-post-grid-square":"","gb-block-post-grid-landscape":"","gb-block-post-grid-square":""},"post_excerpt_stackable_v2":"<p>Introduction Trusted Domains lets you restrict JavaScript SDK traffic to a defined list of domains. Your Refiner Environment ID is included in your frontend JavaScript code and can therefore be discovered by third parties. By configuring Trusted Domains, you can prevent other websites from simply reusing your Environment ID to send JavaScript SDK traffic to your Refiner environment. We recommend configuring Trusted Domains for production environments. Configure Trusted Domains Go to Settings &gt; SDK Security &gt; Trusted Domains and add the domains from which your Refiner JavaScript SDK is allowed to send requests. Enter fully qualified domain names, for example:&hellip;<\/p>\n","category_list_v2":"","author_info_v2":{"name":"Moritz Dausinger","url":"https:\/\/refiner.io\/docs\/author\/user\/"},"comments_num_v2":"0 comments","yoast_head":"<!-- This site is optimized with the Yoast SEO plugin v23.3 - https:\/\/yoast.com\/wordpress\/plugins\/seo\/ -->\n<title>Trusted Domains<\/title>\n<meta name=\"robots\" content=\"index, follow, max-snippet:-1, max-image-preview:large, max-video-preview:-1\" \/>\n<link rel=\"canonical\" href=\"https:\/\/refiner.io\/docs\/kb\/javascript-client\/trusted-domains\/\" \/>\n<meta property=\"og:locale\" content=\"en_US\" \/>\n<meta property=\"og:type\" content=\"article\" \/>\n<meta property=\"og:title\" content=\"Trusted Domains\" \/>\n<meta property=\"og:description\" content=\"Introduction Trusted Domains lets you restrict JavaScript SDK traffic to a defined list of domains. Your Refiner Environment ID is included in your frontend JavaScript code and can therefore be discovered by third parties. By configuring Trusted Domains, you can prevent other websites from simply reusing your Environment ID to send JavaScript SDK traffic to [...]Read More...\" \/>\n<meta property=\"og:url\" content=\"https:\/\/refiner.io\/docs\/kb\/javascript-client\/trusted-domains\/\" \/>\n<meta property=\"og:site_name\" content=\"Refiner Documentation\" \/>\n<meta property=\"article:modified_time\" content=\"2026-09-03T16:06:00+00:00\" \/>\n<meta property=\"og:image\" content=\"https:\/\/refiner.io\/docs\/wp-content\/uploads\/2026\/09\/Screenshot-2026-09-03-at-18.05.07-1024x464.png\" \/>\n<meta name=\"twitter:card\" content=\"summary_large_image\" \/>\n<meta name=\"twitter:label1\" content=\"Est. reading time\" \/>\n\t<meta name=\"twitter:data1\" content=\"2 minutes\" \/>\n<script type=\"application\/ld+json\" class=\"yoast-schema-graph\">{\"@context\":\"https:\/\/schema.org\",\"@graph\":[{\"@type\":\"WebPage\",\"@id\":\"https:\/\/refiner.io\/docs\/kb\/javascript-client\/trusted-domains\/\",\"url\":\"https:\/\/refiner.io\/docs\/kb\/javascript-client\/trusted-domains\/\",\"name\":\"Trusted Domains\",\"isPartOf\":{\"@id\":\"https:\/\/refiner.io\/docs\/#website\"},\"primaryImageOfPage\":{\"@id\":\"https:\/\/refiner.io\/docs\/kb\/javascript-client\/trusted-domains\/#primaryimage\"},\"image\":{\"@id\":\"https:\/\/refiner.io\/docs\/kb\/javascript-client\/trusted-domains\/#primaryimage\"},\"thumbnailUrl\":\"https:\/\/refiner.io\/docs\/wp-content\/uploads\/2026\/09\/Screenshot-2026-09-03-at-18.05.07-1024x464.png\",\"datePublished\":\"2026-09-03T14:15:30+00:00\",\"dateModified\":\"2026-09-03T16:06:00+00:00\",\"breadcrumb\":{\"@id\":\"https:\/\/refiner.io\/docs\/kb\/javascript-client\/trusted-domains\/#breadcrumb\"},\"inLanguage\":\"en-US\",\"potentialAction\":[{\"@type\":\"ReadAction\",\"target\":[\"https:\/\/refiner.io\/docs\/kb\/javascript-client\/trusted-domains\/\"]}]},{\"@type\":\"ImageObject\",\"inLanguage\":\"en-US\",\"@id\":\"https:\/\/refiner.io\/docs\/kb\/javascript-client\/trusted-domains\/#primaryimage\",\"url\":\"https:\/\/refiner.io\/docs\/wp-content\/uploads\/2026\/09\/Screenshot-2026-09-03-at-18.05.07.png\",\"contentUrl\":\"https:\/\/refiner.io\/docs\/wp-content\/uploads\/2026\/09\/Screenshot-2026-09-03-at-18.05.07.png\",\"width\":1708,\"height\":774},{\"@type\":\"BreadcrumbList\",\"@id\":\"https:\/\/refiner.io\/docs\/kb\/javascript-client\/trusted-domains\/#breadcrumb\",\"itemListElement\":[{\"@type\":\"ListItem\",\"position\":1,\"name\":\"Home\",\"item\":\"https:\/\/refiner.io\/docs\/\"},{\"@type\":\"ListItem\",\"position\":2,\"name\":\"Trusted Domains\"}]},{\"@type\":\"WebSite\",\"@id\":\"https:\/\/refiner.io\/docs\/#website\",\"url\":\"https:\/\/refiner.io\/docs\/\",\"name\":\"Refiner Documentation\",\"description\":\"\",\"publisher\":{\"@id\":\"https:\/\/refiner.io\/docs\/#organization\"},\"potentialAction\":[{\"@type\":\"SearchAction\",\"target\":{\"@type\":\"EntryPoint\",\"urlTemplate\":\"https:\/\/refiner.io\/docs\/?s={search_term_string}\"},\"query-input\":\"required name=search_term_string\"}],\"inLanguage\":\"en-US\"},{\"@type\":\"Organization\",\"@id\":\"https:\/\/refiner.io\/docs\/#organization\",\"name\":\"Refiner Documentation\",\"url\":\"https:\/\/refiner.io\/docs\/\",\"logo\":{\"@type\":\"ImageObject\",\"inLanguage\":\"en-US\",\"@id\":\"https:\/\/refiner.io\/docs\/#\/schema\/logo\/image\/\",\"url\":\"https:\/\/refiner.io\/docs\/wp-content\/uploads\/2022\/11\/cropped-Group-8.png\",\"contentUrl\":\"https:\/\/refiner.io\/docs\/wp-content\/uploads\/2022\/11\/cropped-Group-8.png\",\"width\":400,\"height\":61,\"caption\":\"Refiner Documentation\"},\"image\":{\"@id\":\"https:\/\/refiner.io\/docs\/#\/schema\/logo\/image\/\"}}]}<\/script>\n<!-- \/ Yoast SEO plugin. -->","yoast_head_json":{"title":"Trusted Domains","robots":{"index":"index","follow":"follow","max-snippet":"max-snippet:-1","max-image-preview":"max-image-preview:large","max-video-preview":"max-video-preview:-1"},"canonical":"https:\/\/refiner.io\/docs\/kb\/javascript-client\/trusted-domains\/","og_locale":"en_US","og_type":"article","og_title":"Trusted Domains","og_description":"Introduction Trusted Domains lets you restrict JavaScript SDK traffic to a defined list of domains. Your Refiner Environment ID is included in your frontend JavaScript code and can therefore be discovered by third parties. By configuring Trusted Domains, you can prevent other websites from simply reusing your Environment ID to send JavaScript SDK traffic to [...]Read More...","og_url":"https:\/\/refiner.io\/docs\/kb\/javascript-client\/trusted-domains\/","og_site_name":"Refiner Documentation","article_modified_time":"2026-09-03T16:06:00+00:00","og_image":[{"url":"https:\/\/refiner.io\/docs\/wp-content\/uploads\/2026\/09\/Screenshot-2026-09-03-at-18.05.07-1024x464.png"}],"twitter_card":"summary_large_image","twitter_misc":{"Est. reading time":"2 minutes"},"schema":{"@context":"https:\/\/schema.org","@graph":[{"@type":"WebPage","@id":"https:\/\/refiner.io\/docs\/kb\/javascript-client\/trusted-domains\/","url":"https:\/\/refiner.io\/docs\/kb\/javascript-client\/trusted-domains\/","name":"Trusted Domains","isPartOf":{"@id":"https:\/\/refiner.io\/docs\/#website"},"primaryImageOfPage":{"@id":"https:\/\/refiner.io\/docs\/kb\/javascript-client\/trusted-domains\/#primaryimage"},"image":{"@id":"https:\/\/refiner.io\/docs\/kb\/javascript-client\/trusted-domains\/#primaryimage"},"thumbnailUrl":"https:\/\/refiner.io\/docs\/wp-content\/uploads\/2026\/09\/Screenshot-2026-09-03-at-18.05.07-1024x464.png","datePublished":"2026-09-03T14:15:30+00:00","dateModified":"2026-09-03T16:06:00+00:00","breadcrumb":{"@id":"https:\/\/refiner.io\/docs\/kb\/javascript-client\/trusted-domains\/#breadcrumb"},"inLanguage":"en-US","potentialAction":[{"@type":"ReadAction","target":["https:\/\/refiner.io\/docs\/kb\/javascript-client\/trusted-domains\/"]}]},{"@type":"ImageObject","inLanguage":"en-US","@id":"https:\/\/refiner.io\/docs\/kb\/javascript-client\/trusted-domains\/#primaryimage","url":"https:\/\/refiner.io\/docs\/wp-content\/uploads\/2026\/09\/Screenshot-2026-09-03-at-18.05.07.png","contentUrl":"https:\/\/refiner.io\/docs\/wp-content\/uploads\/2026\/09\/Screenshot-2026-09-03-at-18.05.07.png","width":1708,"height":774},{"@type":"BreadcrumbList","@id":"https:\/\/refiner.io\/docs\/kb\/javascript-client\/trusted-domains\/#breadcrumb","itemListElement":[{"@type":"ListItem","position":1,"name":"Home","item":"https:\/\/refiner.io\/docs\/"},{"@type":"ListItem","position":2,"name":"Trusted Domains"}]},{"@type":"WebSite","@id":"https:\/\/refiner.io\/docs\/#website","url":"https:\/\/refiner.io\/docs\/","name":"Refiner Documentation","description":"","publisher":{"@id":"https:\/\/refiner.io\/docs\/#organization"},"potentialAction":[{"@type":"SearchAction","target":{"@type":"EntryPoint","urlTemplate":"https:\/\/refiner.io\/docs\/?s={search_term_string}"},"query-input":"required name=search_term_string"}],"inLanguage":"en-US"},{"@type":"Organization","@id":"https:\/\/refiner.io\/docs\/#organization","name":"Refiner Documentation","url":"https:\/\/refiner.io\/docs\/","logo":{"@type":"ImageObject","inLanguage":"en-US","@id":"https:\/\/refiner.io\/docs\/#\/schema\/logo\/image\/","url":"https:\/\/refiner.io\/docs\/wp-content\/uploads\/2022\/11\/cropped-Group-8.png","contentUrl":"https:\/\/refiner.io\/docs\/wp-content\/uploads\/2022\/11\/cropped-Group-8.png","width":400,"height":61,"caption":"Refiner Documentation"},"image":{"@id":"https:\/\/refiner.io\/docs\/#\/schema\/logo\/image\/"}}]}},"_links":{"self":[{"href":"https:\/\/refiner.io\/docs\/wp-json\/wp\/v2\/knowledgebase\/28988","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/refiner.io\/docs\/wp-json\/wp\/v2\/knowledgebase"}],"about":[{"href":"https:\/\/refiner.io\/docs\/wp-json\/wp\/v2\/types\/knowledgebase"}],"author":[{"embeddable":true,"href":"https:\/\/refiner.io\/docs\/wp-json\/wp\/v2\/users\/1"}],"replies":[{"embeddable":true,"href":"https:\/\/refiner.io\/docs\/wp-json\/wp\/v2\/comments?post=28988"}],"version-history":[{"count":5,"href":"https:\/\/refiner.io\/docs\/wp-json\/wp\/v2\/knowledgebase\/28988\/revisions"}],"predecessor-version":[{"id":28995,"href":"https:\/\/refiner.io\/docs\/wp-json\/wp\/v2\/knowledgebase\/28988\/revisions\/28995"}],"wp:attachment":[{"href":"https:\/\/refiner.io\/docs\/wp-json\/wp\/v2\/media?parent=28988"}],"wp:term":[{"taxonomy":"knowledgebase_tag","embeddable":true,"href":"https:\/\/refiner.io\/docs\/wp-json\/wp\/v2\/knowledgebase_tag?post=28988"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}