Now that I'm using MyDomain, I am noticing that sandboxes have a silly domain name associated with them (e.g., mydomain--sandbox.cs43.my.salesforce.com).

I'd like to whitelist production and all potential sandboxes as referrers for my Google API key, including Standard, VisualForce and Lightning subdomains.

What is a good list of domains I can use for this that will include my production org, and my sandboxes, and ideally no other production orgs?

Google's API Console does allow *'s as wildcards, though it seems that it only works for whole components of the subdomain (mydomain.*.salesforce.org) and doesn't work in the case of mydomain--sandbox.cs*.salesforce.com.

  • This is more of a Stack Overflow question than one for here. – sfdcfox Oct 31 '17 at 5:17
  • @sfdcfox It's a question for the people who know about the potential domains (sandbox and production) in a MyDomain-enabled Salesforce org. The mechanics of whitelisting in Google API Console is fairly simple and not the substance of the question. The only wrinkle that Google throws in is the wildcarding of subdomains (e.g., *.my.salesforce.com) – Charles Koppelman Oct 31 '17 at 5:27
  • @sfdcfox improved? – Charles Koppelman Oct 31 '17 at 5:36
  • 1
    Yeah, I was checking it out, it looks like you'd have to essentially whitelist all of Salesforce, which would be a major potential security issue. Hopefully someone indeed has an answer for this, but I'd still say that this is one of those times you might benefit from cross-posting to Stack Overflow (make sure you link this question to the other). I'm sure lots of Salesforce admins would like to know how to do this. – sfdcfox Oct 31 '17 at 6:23

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Browse other questions tagged or ask your own question.