# YAML array format
GENAISCRIPT_ALLOWED_DOMAINS='["github.com", "*.openai.com", "example.org"]'
```

**Configuration File (genaiscript.config.yml):**

```yaml
allowedDomains:
  - github.com
  - '*.openai.com'
  - example.org
```

**Configuration File (genaiscript.config.json):**

```json
{
  "allowedDomains": ["github.com", "*.openai.com", "example.org"]
}
```

**Script-Level Configuration:** Individual scripts can specify their own allowed domains, which override the global configuration:

```js
script({
  title: "My Script",
  allowedDomains: [
    "github.com",
    "*.openai.com",
    "example.com"
  ]
})


// This script can only access the domains listed above
const response = await host.fetchText("https://api.openai.com/data")
```

Script-level configuration takes precedence over global settings, allowing fine-grained control over domain access per script.

#### Wildcard Patterns

[Section titled “Wildcard Patterns”](#wildcard-patterns)

Domain patterns support glob-style wildcards using [minimatch](https://github.com/isaacs/minimatch):

* `github.com` - Exact match only
* `*.github.com` - Matches any subdomain (e.g., `api.github.com`)
* `*` - Matches all domains (use with caution)

When a domain is blocked, you’ll see an error message like:

```plaintext
Domain 'example.com' is not allowed. Allowed domains: *.
Configure allowed domains via GENAISCRIPT_ALLOWED_DOMAINS environment variable or allowedDomains in script configuration.
```

## Secrets

[Section titled “Secrets”](#secrets)

If the API you are querying requires an API key, you can use the [secrets](/genaiscript/reference/scripts/secrets) object to store the key.

```plaintext
```