Feature
Domain allow-list
Lock each signup endpoint to your own websites, so a form copied onto another domain is rejected instead of filling your list.
Your campaign id is public by design, because it sits in your HTML. The allow-list is what stops anyone else from using it.
How it works
- List the domains allowed to submit to each campaign.
- Every request is checked against its Origin or Referer.
- Submissions from any other site are rejected with DOMAIN_NOT_ALLOWED.