when using tools that create preview deployments like netlify or vercel, you usually want to whitelist a whole subset of domains with predictable uris example: https://deploy-preview-1159--app-home.netlify.app where 1159 is a changing deployment id so ideally you should be able to whitelist deploy-preview-*--app-home.netlify.app a wildcard whitelist would also work, although it's less specific and could allow for abuse in some cases: *. netlify.app