Skip to main content
Apps run in a sandboxed iframe with strict security controls by default. App-level settings let you enable specific features on a per-app basis, giving you fine-grained control over what each app can do.

​
Requirements

Editor permissions or higher on a document are required to edit app settings.

​
How it works

By default, apps can’t make outbound network requests or load external images — the iframe’s Content Security Policy (CSP) blocks them to prevent data exfiltration. Allowed hosts - enabled by turning on specific app settings - are third-party services that the app author doesn’t control, so they can’t be used as a channel to exfiltrate query data. This is unlike a bring-your-own-key provider where the author could read request logs. The app never gains access to 'self', https:, or wildcard origins.

​
Accessing app settings

To access an app’s settings:
  1. In an app, click Edit to enter draft mode.
  2. Near the top left corner of the page, click the icon (located next to Code).

​
Allow map providers

The Omni Agent can enable this setting automatically when you ask it to add a map to your app.
The Allow map providers setting allows maps in your app by enabling it to render tiles from keyless map providers. When enabled, Omni widens the CSP to permit image and network requests to the following map providers’ tile servers and the CDNs their libraries load from. No additional setup is needed.

​
Safe domains

Safe domains lets app editors optionally extend the app’s security model by specifying additional trusted hosts for loading images, scripts, stylesheets, fonts, and network connections.
By default, apps can load resources from a curated list of trusted CDNs (e.g., Google Fonts, jsDelivr) and Omni’s bundled charting, styling, and utility libraries. These are available regardless of your safe domain configuration.

​
Configuring Safe domains

The Omni Agent can also configure safe domains when building or editing an app. For example, you can tell it “load images from cdn.example.com” and it will enable Allow safe domains and add the specified domain.
To configure safe domains for an app:
  1. Open the app’s settings.
  2. In the Safe domains section, toggle Allow safe domains on.
  3. Enter one or more domains in the Safe domains field. Add one domain per line or separate using spaces or commas:
    See Domain formats for formatting requirements.
  4. Click outside the text area to save. The domains are validated when you save.
If you disable Allow safe domains, all external access (excluding map providers if Allow map providers is enabled) for the app will be disabled. Specified domains will be saved and can be re-enabled by toggling the setting back to on.

​
Domain formats

Safe domains accepts the following formats:Each domain must:
  • Have at least two labels (e.g., example.com is valid, but localhost or com alone is not)
  • Use only lowercase letters, digits, hyphens, dots, and optionally a leading *. wildcard
  • Be 253 characters or fewer
  • Include a valid port (5 digits or fewer, numeric) if a port is specified
For example:
Valid domains