Origins

Agent > Origins is where you prove ARCY is allowed to run on a domain, and decide which environments may use it. This is the dashboard side of what Domain verification & session trust explains conceptually.

Adding an origin

Press Add origin and enter a URL, for example https://myapp.com. Verifying myapp.com also verifies www.myapp.com automatically, and vice versa; any other subdomain, like app.myapp.com, needs its own separate verification.

A new origin starts Pending. It is never trusted for anything, CORS or session bootstrap, until you verify it.

Verifying

Each pending row shows the exact DNS TXT record to add: type TXT, name _arcy-verify.<hostname>, value a generated token, each with a copy button. Add it with your DNS provider, then press Verify. If it fails: "Verification failed. Make sure the DNS record name and value match exactly and have propagated, then try again."

localhost is always allowed for local development on common dev ports, with no record needed.

Assigning to environments

Assignment only appears once an origin is Verified; before that its row just says "Verify to assign." Toggle which environments may use it from a checkbox menu, "Used by": every toggle saves immediately, there's no separate save step. If you clear every environment, ARCY refuses sessions from that origin until you pick at least one again.

Removing an origin

An unverified origin is removed immediately with no confirmation. A verified one asks you to type the exact domain to confirm, since it may be assigned to live environments: "This action is irreversible and may break CORS or session bootstrap for apps still using this origin."

See also

• Domain verification & session trust: how this protects your credit budget
• Environments: what an origin is assigned to