> For clean Markdown of any page, append .md to the page URL.
> For a complete documentation index, see https://docs.withpersona.com/2020-05-18/hosted-flow-security/llms.txt.
> For AI client integration (Claude Code, Cursor, etc.), connect to the MCP server at https://docs.withpersona.com/_mcp/server.

# Security

> Restrict Hosted Flow redirect destinations with a domain allowlist.

## Allowed redirect URIs

To ensure that the `redirect-uri` parameter only allows open redirects to known destinations, a domain allowlist can be configured per template, or globally in the [Domain Manager](https://app.withpersona.com/dashboard/manage-domain) page within the Persona Dashboard.

Once you add one or more domains, the Inquiry flow will disallow redirects to destinations not matching those domains.

When specifying domains, only provide the domain. Do not provide a URI scheme (e.g. `https://`).

> Restrict Hosted Flow redirect destinations with a domain allowlist.