How to Unblock and Authorize External Connections?
Questions:
- Why is my shipping-rate lookup, stock check, or live price feed not loading?
- How do I fix an external background tool or live update stream that is frozen on a loading spinner?
- How do I safely allow an outside website or application to call into my shop and access data?
Description:
What you notice: a feature that talks to another company's service in the background isn't working — for example a shipping-rate lookup, a stock check, a live price feed, a search-as-you-type box, or a tool that pushes live updates. Often nothing visible appears, or a "loading" spinner never finishes.
Why this happens:
Your shop now controls two things for safety:
- Where your shop is allowed to send requests (so injected code can't quietly phone home to a criminal's server), and
- Who is allowed to call into your shop from the outside (so other websites can't help themselves to your data).
If a genuine outside service isn't on the right trusted list, the connection is blocked. It just needs approving once.
Solution:
Two cases to considerThere are two slightly different cases. If you're not sure which applies, that's fine — pass this article to your web agency or our support and they'll tell from your browser in a moment.
Case A — your shop needs to reach an outside service
Most common (e.g. a shipping calculator or live feed you added).
-
Navigate to Content Security Policies
Go to System Configuration → Security Configuration → Content security policies.
-
Add the service's web address to the connect src field. e.g., www://api.shipping-company.com
- Save and reload.
Case B — another website needs to call into your shop
Less common (e.g. a partner system or your own separate app pulls data from your shop).
-
Navigate to Access control policies.
Go to System Configuration → Security Configuration → Access control policies.
-
Add the calling website's address to the Allow origin field, e.g., www://partner.example.com.
-
Configure additional developer permissions "Allow methods" or "Allow credentials", if necessary
- Save and reload.
Tips and Tricks:
Pro-Tips:
-
If you are unsure whether your connection issue falls under Case A or Case B, ask your web agency or support team to review your browser network tab.
-
Always provide the complete and exact URL format (including the https:// prefix) when adding trusted addresses to your policy lists.
Warnings:
-
Do not open up access to everyone to make a feature work, because completely removing restrictions defeats the built-in security protections of your shop.
-
Only approve specific, recognized services or partners that you actively utilize for your day-to-day business operations.
Note for your agency: Case A is a CSP connect-src block (also use the wss:// origin for WebSockets, or SecurityUtil::registerDynamicConnectEndpoint("host")). Case B is a CORS issue — the instance only reflects Access-Control-Allow-Origin for hardcoded origins, own domains, or the Allow origin whitelist; methods/credentials are configured under Access control policies.