Origins allowed to send/receive front-channel postMessage with your 3DS return page.
{ "allowed_origins": [ "https://merchant.example.com" ] }