Why You Need an Allowed Origins List
The allowed origins list (allowlist) protects your registration form from being used on unauthorized websites. Without this restriction, anyone could copy the widget code and embed your form on their own site.
This feature is available on the Pro, Business, and Enterprise plans.
How to Add a Domain
- Open the event in tikento.
- Go to the "Registration" tab -> "Widget for Website" section.
- Click "Manage Origins".
- Click "+ Add Domain".
- Enter the domain and click "Save".
Changes take effect immediately -- no page reload is required for the widget.
Domain Entry Formats
| Entry | What It Allows |
|---|---|
yourdomain.com | Apex domain only (no www) |
www.yourdomain.com | www version only |
*.yourdomain.com | All subdomains (but not the apex itself) |
yourdomain.com + *.yourdomain.com | Apex + all subdomains |
yoursite.tilda.ws | A specific Tilda subdomain |
Examples
If your site is conference.example.com:
- Add:
conference.example.com
If you have multiple subdomains (events.example.com, tickets.example.com):
- Add:
*.example.com(or each subdomain individually)
If your site is on Tilda with a custom domain myevent.com:
- Add:
myevent.comandwww.myevent.com
Protocols
Domain permissions automatically apply to both protocols -- http:// and https://. You do not need to specify the protocol when entering a domain.
Localhost for Development
To test the widget locally, add:
localhost127.0.0.1localhost:3000(or your port)
We recommend removing localhost from the list before going to production.
Per-Ticket-Type Restrictions
By default, the allowlist applies to the entire event widget. Individual ticket types cannot have separate lists -- the restriction operates at the event level.
Cache Invalidation
tikento caches the allowed domains list in Redis (TTL 300 seconds). After adding a new domain, the change takes effect within 5 minutes at most, with no additional action required on your part. When widget settings are updated, the cache is invalidated immediately.