8.4Choose where a secret can be used

Each secret has allowed sites: the hostnames where it may be used. A secret is sent only to pages and API requests on these sites, and only over https.

Entry	Matches
`app.example.com`	Exactly `app.example.com`.
`*.example.com`	Any subdomain, at any depth, such as `app.example.com` or `eu.api.example.com`. It does not match `example.com`. Add `example.com` as its own line if you need it.

An entry that starts with *. is a wildcard. It covers every subdomain of the name after it.

Rules for entries#

Enter one site per line. Commas also split entries. Blank lines are ignored.
Enter a hostname only: no https://, no path and no port.
Use a name with at least two parts, such as example.com. *.com is refused.
Use only letters, digits, - and .. A part cannot start or end with -.
Each part is 1 to 63 characters. The whole name is at most 253 characters.
IP addresses are refused.
A secret has 1 to 20 sites. Upper case is changed to lower case, and repeated entries are removed.
The port of a page does not matter when sites are matched.

If an entry breaks a rule, you see a message that starts with invalid input: allowed_hosts entry "<entry>":, such as:

must be a hostname without a scheme, like app.example.com
must be a hostname without a path
must be a hostname without a port
a wildcard is only allowed as a leading "*." label
needs a domain with at least two labels, like example.com
must be a hostname, not an IP address

With no sites, you see invalid input: allowed_hosts needs at least one site, like app.example.com or *.example.com. With more than 20, you see invalid input: allowed_hosts has <N> sites; the limit is 20.

When a check uses a secret on the wrong site#

The check is "down" and shows one of these messages:

Message	What it means and what to do
`secret <NAME> is not allowed on <host>`	The page or request is not on the allowed sites, or the page is not https. Add the site, or fix the monitor.
`secret <NAME> is only sent over https`	An API request uses `http://`. Change it to `https://`.
`redirect not followed: secret <NAME> is not allowed on <host>`	The API request was redirected to another site. Add that site, or point the monitor at the final address.
`secret <NAME> has no allowed sites`	Add allowed sites to the secret (see below).

In a browser check, if the field is inside a frame, both the page and the frame's page must be on the list.

A secret with no allowed sites cannot be used#

Every new secret has at least one site. Some older secrets may have none. Such a secret shows the badge No allowed sites: not usable and a set allowed sites → button. Every check that uses it fails until you add sites. See 8.5 for how.