Sometimes you may want your script or add-on to open a URL in response
to a user action. Other times you may want your script or add-on to
retrieve information from an external location using the Apps Script
UrlFetch service. In both cases you must
allowlist the URLs you open or fetch from in the project manifest.
Allowlisting is the process where you designate specific URLs that are pre-approved for access by your script or add-on. This requirement helps protect user data; if you define a allowlist, script projects can't access URLs that have not been allowlisted. Google Workspace add-ons require URLs to be allowlisted before they can be fetched or opened.
You can allowlist a URL for fetching by adding it or a matching prefix to the
manifest field. For Google Workspace
add-on projects, you can allowlist a URL for
opening by adding it or a matching prefix to the
The prefixes you add to the manifest must satisfy the following requirements:
- Each prefix must be a valid URL.
- Each prefix must use
- Each prefix must have a full domain.
- Each prefix must have a non-empty path. For example,
https://www.google.com/is valid but
- You can use wildcards to match URL subdomain prefixes.
- A single
*wildcard can be used in the
addOns.common.openLinkUrlPrefixesfield to match all links, but this is not recommended as it can expose a user's data to risk and can prolong the add-on review process. Only use a wildcard if your add-on functionality requires it.
When determining if a URL matches a allowlisted prefix, the following rules apply:
- Path matching is case-sensitive.
- If the prefix is identical to the URL, it is a match.
- If the URL is the same or a child of the prefix, it is a match.
For example, the prefix
https://example.com/foo matches the following URLs:
You can use a single wildcard character (
*) to match a subdomain for both the
fields. You can't use more than one wildcard to match multiple subdomains, and
the wildcard must represent the leading prefix of the URL.
For example, the prefix
https://*.example.com/foo matches the following
https://*.example.com/foo doesn't match the following
https://example.com/foo(at least one subdomain must be present)
Some of the prefix rules are enforced when you try to save your manifest. For example, the following prefixes cause an error if they are present in your manifest when you attempt to save:
https://*.*.example.com/foo(multiple wildcards are forbidden)
https://subdomain.*.example.com/foo(wildcards must be used as a leading prefix)