diff --git a/src/index.js b/src/index.js
index a9728ee..4d1d16a 100644
--- a/src/index.js
+++ b/src/index.js
@@ -63,7 +63,7 @@ export default {
 
 		const expId = url.searchParams.get('expId');
 		const participantId = url.searchParams.get('participantId');
-		const pat = /^[a-zA-Z0-9]{1,64}$/;
+		const pat = /^[a-zA-Z0-9_\-]{1,64}$/;
 		if (!expId || !participantId || expId.includes('/') || !participantId.match(pat)) {
 			// prevent path traversal
 			return new Response('Invalid parameters', { status: 400, headers: corsHeaders });