> For clean Markdown of any page, append .md to the page URL.
> For a complete documentation index, see https://docs.coinflow.cash/llms.txt.
> For AI client integration (Claude Code, Cursor, etc.), connect to the MCP server at https://docs.coinflow.cash/_mcp/server.

# Domain Whitelisting for Coinflow Checkout

Coinflow enforces domain whitelisting to ensure your checkout UI only renders on trusted sites you control. This protects your users from phishing, spoofing, and unauthorized transactions.

### Why Domain Whitelisting Matters

Without domain whitelisting, attackers could embed your checkout on fake sites, intercept transactions, or bypass fraud checks. Enforcing whitelisting ensures checkouts only run on trusted domains—keeping transactions secure, user experiences consistent, and your brand protected.

### How It Works

Coinflow verifies the domain at render time using window\.location.origin. The checkout will only load on approved domains, with validation occurring when the iframe loads—not when the link is generated. If the origin isn’t whitelisted, the checkout won’t render.

---

## How to Whitelist a Domain

1. Go to the [Whitelist URLs tab](https://sandbox-merchant.coinflow.cash/frame-ancestors) in your merchant dashboard
2. Click the **`Request URL Whitelist`** button
3. Enter the domain you want to whitelist under **`URL to Whitelist`**
4. Provide a brief explanation of the URL’s purpose under **`Reason for Request`**
5. Notify the Coinflow team once submitted. Your request will be reviewed by the Coinflow team.