> For the complete documentation index, see [llms.txt](https://docs.codemash.io/llms.txt). Markdown versions of documentation pages are available by appending `.md` to page URLs; this page is available as [Markdown](https://docs.codemash.io/cloud/project/settings/access.md).

# Access

**Where:** Project → Settings → Access · `/projects/<project>/settings?tab=Access`

Control how your project is reached: the addresses SDKs and services should call, and the browser origins that may call them. On managed and Enterprise plans the data **Region** settings also live here; self-hosted installs have no regions.

{% hint style="info" %}
Screenshot TODO — capture comes from testing-plan area **17-project-settings**.
{% endhint %}

## Deployment endpoints

Read-only addresses discovered from the Hub `/echo` endpoint — use them when configuring SDKs or external services. Each URL opens in a new tab and has a copy button.

| Field                 | What it shows                                                                                                                                          |
| --------------------- | ------------------------------------------------------------------------------------------------------------------------------------------------------ |
| API URL / API version | Base address and version of the data API — on managed plans, for the project's primary region.                                                         |
| Hub URL / Hub version | Base address and version of the management (Hub) API.                                                                                                  |
| Admin portal URL      | The canonical portal address. If [Brand → Admin portal URL](/cloud/project/settings/brand.md) sets an override, the effective URL is shown underneath. |

## Allowed Origins (CORS)

The websites that may call the project's API from the browser. **Edit** opens a modal with a comma-separated list; whitespace around entries is trimmed. Add every domain where your app or admin portal runs:

```
http://localhost:3000,https://myproject.com
```

A successful save shows **"Project settings updated"**. Requests from origins not on the list are blocked by the browser's CORS check.

## Region Settings (managed and Enterprise plans)

* **Primary region** — where the project's main database and control data live. It is fixed once set and shown read-only.
* **Additional regions** — rendered only when the backend marks the project as eligible for multi-region; other projects see an information notice instead. Tick the regions where app-data databases may also be placed and press **Save regions**. A region that still hosts a database cannot be removed — delete the database first. Constraint errors from the server are shown on the tab.

## Use it from code

See [Account & Projects → Projects](/sdks-and-cli/account/projects.md).

## API reference

Endpoints: [update-project-allowed-origins](/api-reference/account/projects/update-project-allowed-origins.md), [update-project-regions](/api-reference/account/projects/update-project-regions.md).