Prefer exact hosts
Use api.example.com when one known API hostname is sufficient.
API allowlist best practices
Approve the smallest upstream hostname pattern that works
A destination allowlist should describe reviewed public API hosts—not URLs, public suffixes, arbitrary domains, or private networks. ThrottleProxy keeps plain entries exact and wildcard entries to one explicit subdomain level.
Exact hostsOne-level wildcardsPublic APIs only
Practical boundaries
Narrow patterns keep the proxy from becoming an open destination
Make wildcards explicit
Use *.example.com only when multiple immediate subdomains are genuinely required.
One level means one level
*.example.com matches api.example.com, not example.com or v1.api.example.com.
Use host patterns only
Do not include schemes, credentials, ports, paths, query strings, or fragments.
Reject broad suffixes
Top-level domains, public suffixes, wildcard-only patterns, and hosted platform suffixes are too broad.
Pair with target safety
An allowlist match still must pass protocol, port, DNS, private-range, metadata, and self-target checks.
Good fit
- Exact public API hosts documented by the provider.
- Explicit one-level subdomain families with a clear operational need.
- Small reviewed lists that can be audited and removed quickly.
Not a replacement for
- Public suffixes such as com, co.uk, or hosted platform suffixes.
- URLs containing credentials, ports, paths, query values, or fragments.
- Localhost, private addresses, metadata services, or internal DNS names.
Common questions
Does api.example.com match subdomains?
No. Plain host entries are exact-host only.
Does *.example.com match the parent domain?
No. It matches exactly one subdomain label, such as api.example.com, and not example.com.
Is an allowlist match enough to make a target safe?
No. The resolved target must also pass protocol, port, DNS, private-network, metadata, and loop-protection checks.
Start with one narrow integration
Use one workspace key, one exact public host, and non-sensitive test traffic.