Domain restrictions add an extra layer of security to your API keys by limiting which domains can use them. This prevents unauthorized use if your key is ever exposed.

🔒 What are Domain Restrictions?

Domain restrictions allow you to specify which website domains are authorized to use your API key.

How it works:

1. You specify allowed domain(s) when creating an API key
2. Gomap checks the Origin or Referer header of each request
3. Requests from unauthorized domains are rejected with 403 Forbidden

Why Use Domain Restrictions?

Security Benefits

Without domain restrictions:

• Anyone with your API key can use it from any website
• If accidentally exposed, can be abused immediately
• Hard to track down unauthorized usage

With domain restrictions:

• ✅ Key only works on your specified domains
• ✅ Exposed keys are useless to others
• ✅ Additional layer of defense

Real-World Scenario

Your key: gm_abc123...
Allowed domain: [myapp.com](http://myapp.com)

Request from [myapp.com](http://myapp.com)      → ✅ Allowed
Request from [attacker.com](http://attacker.com)    → ❌ Blocked (403)
Request from [localhost](http://localhost)       → ❌ Blocked (403)

Setting Up Domain Restrictions