Origin not allowed

What it means

A web page sent the request from an address that this Auto Runtime doesn't accept browser requests from. A runtime accepts them from Studio, from its own address when it serves Studio, and from the origins its operator lists. Requests without an Origin header, such as those a server or a script sends, aren't checked.

What to do

Read the problem's detail first. It says what happened to this request.

• If you run the runtime, add the page's exact origin, such as https://app.example.com, to ALLOWED_ORIGINS, then restart it. The runtime reads its settings when it starts.
• List only origins whose pages you trust as much as Studio. A page there can act as the person signed in to it, with every permission they have in their organization.
• Or send the request from your own server instead of the browser.

Calling from a browser explains which pages may call a runtime.

Technical details

• Type: https://on.auto/problems/origin_not_allowed
• Status: 403
• Reason: origin_not_allowed

Responses and errors in the HTTP API reference has the full detail. Problem types lists every type.