The signature issued by the main project.

The domain only, without a path: example.com, not example.com/admin/. Keep https:// unless the main project really is served over plain HTTP. The scheme is kept out of the domain field on purpose — some firewalls reject a form that posts one.