# Setting Cross-Origin Resource Sharing (CORS) domains

Source: https://docs.arcxp.com/en/products/subscriptions/managing-subscriptions-settings/setting-cross-origin-resource-sharing--cors--domains.html

Use the CORS page in Subscriptions Settings to control which domains can access your public APIs. This prevents bad actors from attempting to imitate your site or spoof your domain.

Only the domains you add are allowed to access the public APIs. The system restricts all requests from domains not included in this list.

## Scenario: Allowing API access from your site

Your media organization needs to allow your JavaScript application running on `subdomain.example.com` to access resources from your APIs while maintaining security.

You access the CORS Domains section in Subscriptions Settings to add `https://*.example.com` to your allowed origins list.

After saving the configuration, you test the integration and ensure you protect your site by limiting public API access to only trusted domains while ensuring your applications work properly.

## Procedure

## Adding an approved domain

To add new approved domains, complete the following:

1. Navigate to **Subscriptions** \> **Settings** \> **Security** \> **CORS Domains**. The CORS Domains page opens, showing a list of previously approved domains.
2. Enter a domain name in the text field.
3. Click **Add domain**.
4. Click **Save**.

After configuring your first CORS domain, the system automatically adds the admin URL to ensure functionality. You cannot edit or remove this admin URL unless you delete all other domains first.