---
title: "Localhost & development"
description: "CanaryLytics drops localhost origins by default. Allow them for a project by adding localhost as a trusted domain or enabling the \"Allow local origins\" toggle."
last_updated: "2026-07-30"
---

# Localhost & development

`/ingest` drops localhost-ish Origins (`localhost`, `127.0.0.1`, `*.localhost`) by default, because otherwise anyone's dev server could impersonate your production domain. Allow them for a project in one of two ways:

1. **Add `localhost` as a trusted domain** (dashboard, then Settings, then Domains). This is an explicit, permanent allowlist entry, and it also satisfies the check `GET /v1/validate` reports for `originIsLocal` origins.
2. **Enable "Allow local origins"** on the project. One toggle covers `localhost`, `127.0.0.1`, and any `*.localhost` subdomain, without adding each as a domain. It is the same toggle used for [Capacitor/Ionic](/docs/environments/capacitor/) hybrid apps, so turning it off later affects both.

Either way, point `data-api` at your local API instance during development if you're not using the production API:

```html
<script
  src="https://cdn.analytics.canarycoders.es/lytics.js"
  data-domain="myapp.com"
  data-api="http://localhost:3031"
  defer
></script>
```

`data-api` defaults to `https://api.analytics.canarycoders.es`; override it any time you point the tracker at a self-hosted or local API origin. Verify the setup with `GET /v1/validate?domain=...&origin=http://localhost:5173`.

## Related

<CardGrid>
  <LinkCard title="Troubleshooting" description="Reading the /v1/validate response field by field." href="/docs/troubleshooting/" />
  <LinkCard title="Capacitor & Ionic" description="Why production hybrid apps share this toggle." href="/docs/environments/capacitor/" />
</CardGrid>

## Sitemap

- [Docs sitemap](https://analytics.canarycoders.es/docs/sitemap.md)
- [Full documentation as a single file](https://analytics.canarycoders.es/llms-full.txt)