Update the embed domain allowlist

Add, remove, or replace the domains your embedded widgets may load on. Call this from your onboarding backend when a client attaches a CNAME, so their payout widget stops failing with Token domain mismatch.

Send at least one of allowedDomains, addDomains, removeDomains, or allowAllDomains. allowedDomains replaces the whole list and cannot be combined with addDomains or removeDomains; sending both returns 400. When addDomains and removeDomains are sent together, additions are applied first, so a domain in both is removed.

Send bare hostnames. A scheme, port or path is rejected, not stripped, so https://pay.client.com, pay.client.com:3000 and pay.client.com/app all return 400. Entries are lowercased and de-duplicated, every domain must contain a dot (so localhost is rejected), and the resulting list may not exceed 250 entries.

removeDomains matches on the exact stored string: removing *.client.com deletes that wildcard entry and leaves any specific subdomain entries in place.

Sending allowedDomains: [] is valid and clears the list, but addDomains: [] or removeDomains: [] alone returns 400, since neither would change anything.

The response is the full settings object as stored, not just what you sent.

allowAllDomains: true turns the domain check off entirely. It is not a convenience flag for a stubborn Token domain mismatch. With it set, an embed token is accepted from any origin, browser requests are no longer required to send an Origin header, and the per-domain list stops being consulted. Anyone who obtains a token can then use it from a site you do not control. Prefer adding the specific domain.