origin_not_allowed

The request came from an address this key does not allow.

Status: HTTP 403 · Keys and domains

What happened

The request came from an address this key does not allow. The Development app key works from any secure (https) address, such as a browser builder's preview, a host's preview deploy or your own domain, and from localhost, before and after go-live, with nothing to list. The Live app key works only on the app's verified domains. A Live key on a local page is told: "Your Live app key refuses local pages; work locally with your Development app key or npx gemmein dev.". A Development key on any other local address is told: "With a Development app key, local pages work only on localhost or 127.0.0.1, over http or https.". Plain http on a public name, a file or a sandboxed frame is told: "A Development app key works from any secure (https) address, and over plain http only on localhost or 127.0.0.1.". On npx gemmein dev, any other named address is told: "npx gemmein dev allows pages on http://localhost and http://127.0.0.1 only. To call from a public https address, use your cloud Development app key (npx gemmein keys app prints it).". The body carries reason (no_key, secret_key, unknown_key, local, address, domain or insecure) to branch on, never the sentence, and, once the key names an app, live (true once the app is live) and environment (development or production: whose rule refused the page). A key problem is about the key, whatever the page's address. With no key: "This request has no app key. Add the app key npx gemmein keys app prints.". With a secret key: "A secret key never goes in a browser. Use the app key npx gemmein keys app prints.". With a key Gemmein doesn't know: "This app key isn't recognised. Use the app key npx gemmein keys app prints.". On npx gemmein dev the same three point at the key it prints instead: "This request has no app key. Add the app key npx gemmein dev prints (pk_local_…).". "A secret key never goes in a browser. Use the app key npx gemmein dev prints (pk_local_…).". "This app key isn't recognised by gemmein dev. Use the app key npx gemmein dev prints (pk_local_…).". A refused https address on the Live key shows on the dashboard's Errors page.

What to do

Add and verify the domain the app goes live on (a host's preview address can't be added) Never retry.

Read more

• origin_not_allowed in the error table
• forbidden vs denied
• Keys and environments
• Domains (dashboard guide)
• API keys (dashboard guide)
• Changelog: when codes were added or removed