> For the complete documentation index, see [llms.txt](https://codemash.gitbook.io/codemash/llms.txt). Markdown versions of documentation pages are available by appending `.md` to page URLs; this page is available as [Markdown](https://codemash.gitbook.io/codemash/cloud/project/settings/access.md).

# Access

Allow web origins (CORS), choose what the Admin Portal shows before sign-in, write the legal documents, and set regions.

**Where:** Project → Settings → **Access** · `/projects/<project>/settings?tab=Access`

The **Access** tab controls how the project is reached: the addresses to call, the websites that may call it from a browser (CORS), what the Admin Portal shows before anyone signs in, your Terms & Conditions and Privacy Policy, and (managed service and Enterprise) the regions.

| Section                                      | What it holds                                                                                                                                            |
| -------------------------------------------- | -------------------------------------------------------------------------------------------------------------------------------------------------------- |
| Deployment endpoints                         | Read-only **API URL**, **API version**, **Hub URL**, **Hub version** and **Admin portal URL** for the project's primary region, each with a copy button. |
| CORS                                         | **Allowed Origins (CORS)**.                                                                                                                              |
| Admin Portal — what is public before sign-in | **Show brand** (on by default), **Show sign-in options** and **Show legal documents** (off by default).                                                  |
| Legal documents                              | **Terms & Conditions** and **Privacy Policy** in Markdown, **Save documents**.                                                                           |
| Region Settings                              | Primary region (fixed) and additional regions — managed service and Enterprise only.                                                                     |

## Before you start

* An account role that may update the project settings.
* The exact origin of your web app: scheme and host, no path — for example `https://app.acme.example.com` or `http://localhost:3000`.

## Steps

1. Open **Settings → Access**.

   <figure><img src="https://712692422-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2FHy372bqsaex2cqS3ikhL%2Fuploads%2Fgit-blob-fff450663d8e3fc873ae999b4aeff555d7f2e538%2Faccess-1.png?alt=media" alt="Access tab: Deployment endpoints, CORS with the Allowed Origins row, and the three Admin Portal switches"><figcaption><p>The Access tab of Acme Store.</p></figcaption></figure>
2. Next to **Allowed Origins (CORS)** press **Change**. The dialog **Project Allowed Origins (CORS)** shows the current list, separated by commas. Add your origin at the end — keep the others — and press **Submit**.

   | Field                  | Required | What it does                                                                                                                  | Example                                                                                                |
   | ---------------------- | -------- | ----------------------------------------------------------------------------------------------------------------------------- | ------------------------------------------------------------------------------------------------------ |
   | Allowed Origins (CORS) | yes      | Every web origin that may call the project's API from a browser. The project's own Admin Portal origin must stay in the list. | `http://pr_7fukofhebnmniskqust2de.<host>,https://portal.acme.example.com,https://app.acme.example.com` |

   <figure><img src="https://712692422-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2FHy372bqsaex2cqS3ikhL%2Fuploads%2Fgit-blob-5795bd095630e978261a6c9c747e219efe629994%2Faccess-2.png?alt=media" alt="Project Allowed Origins (CORS) dialog with three origins"><figcaption><p>Adding https://app.acme.example.com.</p></figcaption></figure>
3. Under **Admin Portal — what is public before sign-in**, switch what the portal's sign-in screen may show: **Show brand** (name, logo and colours), **Show sign-in options** (sign-in methods and password rules) and **Show legal documents** (public Terms and Privacy pages). Each switch saves at once.
4. Under **Legal documents**, write **Terms & Conditions** and **Privacy Policy** in Markdown, for example `# Terms & Conditions` and a paragraph, and press **Save documents** (enabled only when something changed). Turn on **Show legal documents** to publish them.
5. (Managed service, Enterprise) Under **Region Settings**, tick additional regions and press **Save regions**. Projects that are not eligible see **Multi-region is not available**.

## Result

* **CORS** — the dialog closes, **Project settings updated** shows, and the row lists the origins (stored with a trailing `/`).
* **Switches** — a message such as *Brand now hidden in the Admin Portal before sign-in*; the switch keeps its place after a reload.
* **Legal documents** — **Legal documents have been saved**. With **Show legal documents** on, the hint reads **Both documents are public.** with the two public links `<Admin portal URL>/legal/terms` and `/legal/privacy`.

<figure><img src="https://712692422-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2FHy372bqsaex2cqS3ikhL%2Fuploads%2Fgit-blob-260e2c5b8a3d03d9e25fd81d04706f9038372091%2Faccess-3.png?alt=media" alt="CORS row with three origins, Show brand and Show legal documents on, the two documents saved and the public links"><figcaption><p>After the changes: three origins, legal documents public.</p></figcaption></figure>

{% hint style="warning" %}
The CORS list is saved, but the API does not read it yet: a browser call from a saved origin still gets no `Access-Control-Allow-Origin`. See the [CORS guide](/codemash/api-reference/guides/cors.md).
{% endhint %}

## Change or remove it later

* **Remove an origin** — **Change**, delete it from the list, **Submit**. The whole list is replaced on every save. A list without the project's own Admin Portal origin is refused (*…drops the project's own Admin Portal origin*, `CM-ERRORS-PROJECTS-037`); an invalid entry such as `not a url` refuses the whole save (*Domain URL format is invalid*).
* **Legal documents** — a save always sends both boxes; an empty box removes that document. Turn **Show legal documents** off to unpublish them.
* **Regions** — a region that still hosts a database cannot be removed.

## Do it from code

```ts
await norbix.hub.account.updateProjectAllowedOrigins({
  projectId: 'pr_7FUKofhEBNMnISkqust2De',
  origins: ['http://pr_7fukofhebnmniskqust2de.dspa.norbix.test', 'https://portal.acme.example.com', 'https://app.acme.example.com'],
});
```

```sh
norbix project cors --project pr_7FUKofhEBNMnISkqust2De
```

The client setup is on the [Account page](/codemash/cloud/account.md#use-it-from-code). API: [Update Project Allowed Origins](/codemash/api-reference/account/projects/update-project-allowed-origins.md) · [Update Project Legal Documents](/codemash/api-reference/account/projects/update-project-legal-documents.md) · [Update Project Expose Legal](/codemash/api-reference/account/projects/update-project-expose-legal.md) · [Update Project Expose Brand](/codemash/api-reference/account/projects/update-project-expose-brand.md) · [Update Project Expose Auth](/codemash/api-reference/account/projects/update-project-expose-auth.md) · [Update Project Regions](/codemash/api-reference/account/projects/update-project-regions.md)