Domains and verification

allowed_origins decides which websites may send browser events with a property's public keys. Domain verification is a separate step that records that you control a domain; it does not change which origins may send events.

In this page

• Allowed origins
• Domain verification
• Verification methods

Allowed origins

Set the list when you create the property, or later with PATCH. In Kentro GO, use the property's Domains tab.

curl -sS -X PATCH https://apis.kentro.live/pixel/v1/properties/$PROPERTY_ID \
  -H "Authorization: Bearer $KENTRO_TOKEN" \
  -H "Content-Type: application/json" \
  -d '{ "allowed_origins": ["example.com", "*.example.com"] }'

🚧

Signup forms need an allowlist

The SDK's form command (Kentro Email signup capture) fails closed: it is refused unless the property has a non-empty allowed_origins that contains the page's host. A Kentro GO landing page property uses Kentro GO's landing page host. See Signup forms.

Domain verification

Register the domain on the property, publish the token, then ask Kentro to check it.

curl -sS https://apis.kentro.live/pixel/v1/properties/$PROPERTY_ID/domains \
  -H "Authorization: Bearer $KENTRO_TOKEN" \
  -H "Content-Type: application/json" \
  -d '{ "domain": "www.example.com" }'

{
  "domain": {
    "id": "0192f0c6-2b3c-7d4e-8f50-6a7b8c9d0e1f",
    "domain": "www.example.com",
    "verification_token": "Jk8x2mQ4Vn7pR1tY5wZ9bC3dF6gH0jL2",
    "verified_at": null,
    "verification_method": null,
    "created_at": "2026-10-09T17:12:00.000Z",
    "instructions": {
      "dns_txt": "TXT www.example.com (or _kentro-pixel.www.example.com) = \"kentro-pixel-verification=Jk8x2mQ4Vn7pR1tY5wZ9bC3dF6gH0jL2\"",
      "http_file": "https://www.example.com/.well-known/kentro-pixel-verification.txt containing Jk8x2mQ4Vn7pR1tY5wZ9bC3dF6gH0jL2",
      "meta_tag": "<meta name=\"kentro-pixel-verification\" content=\"Jk8x2mQ4Vn7pR1tY5wZ9bC3dF6gH0jL2\">"
    }
  }
}

• Domains are lower-cased public host names; a leading https://, a path and a port are stripped.
• IP addresses, localhost and names ending in .local, .internal or .localdomain are refused with 400.
• A domain can be registered once per Kentro workspace (409 Conflict otherwise).
• Remove a domain with DELETE /v1/properties/:id/domains/:domainId.

Verification methods

For http_file and meta_tag, Kentro fetches over HTTPS from public addresses only, with a 5 second timeout, does not follow redirects (a redirect counts as not verified), needs a 2xx answer and reads the first 256 KB.

Then run the check:

curl -sS https://apis.kentro.live/pixel/v1/properties/$PROPERTY_ID/verify \
  -H "Authorization: Bearer $KENTRO_TOKEN" \
  -H "Content-Type: application/json" \
  -d '{ "method": "dns_txt", "domain": "www.example.com" }'

{ "verified": true, "method": "dns_txt", "domain": "www.example.com", "verified_at": "2026-10-09T17:20:00.000Z", "detail": "TXT record found on www.example.com" }

A failed check answers 422 with "verified": false and a detail such as no TXT record kentro-pixel-verification=... on www.example.com or _kentro-pixel.www.example.com. A domain that is not registered on that property answers 404.

📘

Verification and the allowlist are separate

Verification records ownership (verified_at on the domain and, the first time, on the property). It does not add the domain to allowed_origins and does not gate ingestion: allowed_origins alone decides which websites may send events.