Trusted Domains for API Keys – Allow Only Approved Websites to Use Your Credentials

Applies To
----------

HERE Platform
API Key authentication
Identity and Access Management (IAM)

Symptom
-------

You want to restrict the use of your API Key so that requests are accepted only from approved websites or applications.

You may also need to manage a large number of allowed domains and discover that only a limited number can be added through the web interface.

Answer
------

Trusted Domains provide an additional security control for API Key credentials by limiting which websites can make requests using your API Key. By default, any website can submit requests with a valid API Key unless Trusted Domains are configured.

Add every website that is expected to make API calls using the API Key.

Each entry must:

Be a valid URI.
Include a domain name or an IPv4 address.
Optionally include an HTTP/HTTPS protocol and port number. When specified, those values are validated as part of the request origin.

###

### Examples

https://production.example.com:1080

example.com

93.184.216.34

http://www.example.com

Expected Behavior

When Trusted Domains are configured:

Requests originating from configured domains are allowed.
Requests originating from domains not present in the Trusted Domains list may be rejected according to credential validation rules.

Limitations
-----------

Up to 20 trusted domains can be added through the web UI.
Up to 3,000 trusted domains can be configured in total.
To manage more than 20 domains, use the HERE CLI.

Recommended Actions
-------------------

1. Identify all domains that legitimately use the API Key.
2. Add those domains to the Trusted Domains configuration.
3. If more than 20 domains are required, use the HERE CLI to manage the additional entries.

Additional Information
----------------------

The source article references:

HERE Identity and Access Management documentation for Trusted Domains: https://docs.here.com/identity-and-access-management/reference/enabletrusteddomains
* HERE CLI documentation for large-scale domain management: https://docs.here.com/workspace/docs/olp-cli-topics-app-app-domain-commands

Keywords / Tags
---------------

trusted-domains, api-key, credentials, security, access-control, iam, authentication, domain-whitelist, allowed-origins, cli, web-ui, platform-security, api-protection, trusted-sites