Configure a Custom App‑to‑App Allow List

The default allow list settings depend on when your team was created:

• For teams created before February 23, 2021, the allow list defaults to all callbacks allowed.

• For teams created after February 23, 2021, the allow list defaults to no callbacks allowed.

Note:In both cases, we recommend that you configure a custom App‑to‑App allow list.

Prerequisites

• You must have Admin user permissions with access to team-level settings.

• Your ProntoForms Team must be on the Advanced or Enterprise tier.

• You must know the registered URL scheme for the third-party app that you want to include in the allow list.

Steps to configure an App‑to‑App allow list

1. In the ProntoForms Web Portal, go to Username > Team Settings.

   

2. On the Security tab, in the App‑to‑App Allow List section, select the down arrow to change the settings. You can choose from the following options:

   • No callbacks allowed

   • Callbacks allowed to specific apps and URLs

   • All callbacks allowed (not recommended)

   Warning:If you share data from forms in App‑to‑App callbacks, we recommend that you define an allow list. This limits the URLs and apps that can receive the data and guards against unintended sharing of information.

3. To define an allow list, select Callbacks allowed to specific apps and URLs, and then enter up to ten app protocols and URLs.

   Note: The following restrictions apply:

   • App protocols must have the format app:// and contain only alphanumeric, hyphen (-), or underscore characters. For example:

     shortcuts://

   • URLs must begin with https:// and contain a valid domain name. For example:

     https://www.company.com/

   • You can enter up to ten items.

4. To save and apply the settings, select Update.

   Result: If you send a callback request that contains an app or URL that’s not on the allowed list, the ProntoForms app blocks the entire request.

Tip:Remind your mobile device users to Reconcile after you update the allow list.