# `ORIGIN_NOT_ALLOWED` (HTTP 403): the page's origin is not on the key's allowed list

The Origin header of the browser request does not match any domain the publishable key allows, or the header is missing.

Each publishable key is locked to the domains you list at creation, so a key copied out of your page source cannot be used from another site. A missing Origin header is rejected on purpose: server-side code should use a secret key.

**What to do.** Add the site's exact host to the key's allowed domains, or create a key for that site. For server-side lookups use a secret sk_live_ key against POST /api/v1/email.

```json
{
    "success": false,
    "error": {
        "code": "ORIGIN_NOT_ALLOWED",
        "message": "This publishable key cannot be used from this origin.",
        "request_id": "req_01m1kgdm4xngzmbmff68g94w0c"
    }
}
```

Reference: https://spaw.co/docs/errors/ORIGIN_NOT_ALLOWED