Paste a full URL or a bare domain — it is stored as a domain. A whitelisted domain matches itself and every subdomain (www., go., …). When enforcement is ON, the bot aborts any visit to a domain not listed here.

Shown by the bot when a non-whitelisted URL is blocked (phase 2 client).

The mimic PC app sends this in X-Client-Key to fetch GET /api/v1/config and report blocked attempts. Rotating it instantly invalidates the old key — update the app's settings after rotating.