Configure allowed domains in your space settings to control which website origins may read video resources in the browser. Mave uses these domains for CORS (Cross-Origin Resource Sharing). No playback token is required for this setting.

CORS is enforced by browsers. It is not viewer authentication and does not prevent direct access outside those browser checks. A public video remains public.

For private videos that require a JWT, use Secure video playback.