ORIGIN_NOT_ALLOWED

The page's origin is not on the key's allowed list

The Origin header of the browser request does not match any domain the publishable key allows, or the header is missing.

http status: 403
credits: Nothing is billed for a failed request.

What it means

Each publishable key is locked to the domains you list at creation, so a key copied out of your page source cannot be used from another site. A missing Origin header is rejected on purpose: server-side code should use a secret key.

What to do

Add the site's exact host to the key's allowed domains, or create a key for that site. For server-side lookups use a secret sk_live_ key against POST /api/v1/email.

Example response

{
    "success": false,
    "error": {
        "code": "ORIGIN_NOT_ALLOWED",
        "message": "This publishable key cannot be used from this origin.",
        "request_id": "req_01m1kgdm4xngzmbmff68g94w0c"
    }
}

Every error carries the request_id also sent in the X-Request-Id header; quote it when writing to support.

markdown version: /docs/errors/ORIGIN_NOT_ALLOWED.md

ORIGIN_NOT_ALLOWED

What it means

What to do

Example response

Related