# Requesting a callback domain

The current host allowlist contains only `notify.bro3.net`. This is a repository
policy, not a claim of platform approval. URLs remain blank by default; supplying
a host does not provision a receiver or grant access to that service.

1. Open a [domain request](https://github.com/chookg/ComfyUI-ChickTools/issues/new?template=domain-request.yml)
   or a PR. Provide the exact hostname, the intended notification use, how you can
   demonstrate control of the domain, and how received data is handled. Use example
   paths without credentials; keep private tokens out of issues and workflows.
2. The repository maintainer reviews the domain and endpoint behavior. A domain
   should resolve to public addresses and receive callbacks without redirects.
   Wildcards, broad parent domains and uncontrolled forwarding destinations are
   outside this policy.
3. Accepted additions update `ALLOWED_CALLBACK_HOSTS` in
   `utils/callback_policy.py`, the node help, documentation and security tests.
   There is no automatic discovery, remote list download or workflow override.
4. The maintainer submits the changed policy and source revision to the relevant
   upstream/platform reviewers. ComfyUI-Manager catalog review and RunningHub
   installation review are separate processes. Each platform decides whether and
   when to accept and install the updated version; a merged repository PR alone
   does not authorize additional cloud callback destinations.

Existing installations keep the policy bundled with their installed revision.
Normal users can edit their endpoint path, task `id` and `msg`, but cannot expand
the accepted host list through a workflow.