Site settings
Open a site from Delivery › Delivery › Sites. Its screen has six sections. Three of them hold settings that belong to your whole organization rather than to this site, and each says so.
| Section | Applies to | Takes effect | Who can change it |
|---|---|---|---|
| Settings | This site | After the next deploy | Owner, Admin |
| Meter time zone | Your organization | After the next deploy | Owner, Admin, Developer |
| Transactional mail | Your organization | At once | Owner, Admin |
| Configuration | Read-only | ||
| Raw overrides | Read-only | ||
| API keys | This site | At once | Owner, Admin |
The page header shows the site’s status, and a denies all origins mark when the site allows no browser origin.
Settings
Section titled “Settings”One Save covers the whole section; Revert discards what you have not saved. Changes are written to the draft and reach requests after the next deploy from Delivery › Deployments › Versions; see Stage and deploy a change.
If someone else saved the same site after you opened it, the save is refused with Someone else changed this site while you were editing it. Reload and reapply your change.
The label the console shows for the site. It decides nothing at runtime. Required, up to 200 characters. Renaming a site does not change its id.
Domain
Section titled “Domain”The hostname the site serves on: no scheme, no port, no path, up to 128 characters. Two sites cannot share a domain. The domain is not added to Allowed origins; list it there yourself if browsers on it call EdgeKit.
Status
Section titled “Status”active or disabled. Only an active site serves requests. A disabled site answers the client API and decide
exactly as an unknown site would: 404 not_found, Unknown site.. Its API keys stay valid, but every request
that selects the site gets the same 404. The collector still accepts events for it. Set the status back to
active and deploy to restore it.
Allowed origins
Section titled “Allowed origins”The browser origins that may call EdgeKit for this site: the client API and decide alike. A browser request whose
Origin header is not on the list is refused with 403 forbidden, This origin is not allowed for the selected site., and the response carries no CORS headers.
- One origin per line: scheme, host and port exactly as the browser sends them, for example
https://www.daily.example. No path, no trailing slash. - Every subdomain is its own origin. An entry containing
*never matches anything. - At most 50 entries.
- Empty refuses every browser request the list is checked on. A site with no allowed origin looks healthy in the
console and answers those browser calls with
403. Only routes that need no credential, such asGET /v1/id/config, answer any origin. The form warns while the list is empty, but a deploy does not refuse it.
A request with no Origin header, from a server or a mobile app, is not checked against this list. A browser
request that left the header out but says in its fetch metadata that it came from another site is still refused.
Redirect origins
Section titled “Redirect origins”The origins an absolute redirect target, such as the callback in a magic link, may point at. A relative path is always allowed, even when the list is empty. Same format and limit as allowed origins.
An absolute target on an origin not in the list is refused with 403 forbidden, That redirect target is not registered for this site.. A malformed target gets 400 bad_request, Invalid redirect target..
Meter time zone
Section titled “Meter time zone”Calendar meter periods (a day, a week, a month) roll over at midnight in this time zone. It applies to your whole
organization, not only to this site. Pick an IANA time zone name, such as Europe/London. The change reaches
requests after the next deploy.
Transactional mail
Section titled “Transactional mail”Sets how your organization’s sign-in links, one-time codes and organization invitations are sent. It applies to your whole organization, not only to this site, and it takes effect on the next request, with no deploy.
- Email provider: Not configured, Resend or SendGrid.
- Sender name: the display name mail is sent under. Optional.
- Sender address: the address mail is sent from. Must be an email address.
Mail goes through the chosen email provider only when the email provider, the sender address and that email provider’s API key are all in place. The API key is not entered on this screen.
Configuration
Section titled “Configuration”Read-only. Shows your organization’s configuration as saved, with this site’s own overrides applied, in four groups: Identification, Support access, Access policy and Schemas.
- A value marked site is set on this site only. The organization’s value is shown below it.
- A value marked not read yet is stored, and nothing at runtime reads it. Changing it changes nothing.
Raw overrides
Section titled “Raw overrides”Read-only. Every override this site carries, exactly as stored, including any the Configuration section has no row for. Empty means the site uses your organization’s value for every setting.
API keys
Section titled “API keys”The site’s server-to-server credentials. Each key is pinned to this site. Issuing and revoking keys is covered in Issue and revoke API keys.