---
title: "Origin not allowed"
description: "A web page sent the request from an address that this Auto Runtime doesn't accept browser requests from."
url: "https://on.auto/problems/origin_not_allowed"
last_updated: "2026-11-10T14:41:54+00:00"
---

# Origin not allowed

## What it means

A web page sent the request from an address that this Auto Runtime doesn't accept browser requests from. A runtime accepts them from Studio, from its own address when it serves Studio, and from the origins its operator lists. Requests without an `Origin` header, such as those a server or a script sends, aren't checked.

## What to do

Read the problem's `detail` first. It says what happened to this request.

*   If you run the runtime, add the page's exact origin, such as `https://app.example.com`, to `ALLOWED_ORIGINS`, then restart it. The runtime reads its settings when it starts.
*   List only origins whose pages you trust as much as Studio. A page there can act as the person signed in to it, with every permission they have in their organization.
*   Or send the request from your own server instead of the browser.

[Calling from a browser](https://on.auto/docs/self-host/security#calling-from-a-browser) explains which pages may call a runtime.

## Technical details

*   Type: `https://on.auto/problems/origin_not_allowed`
*   Status: 403
*   Reason: `origin_not_allowed`

[Responses and errors](https://on.auto/docs/reference/http#responses-and-errors) in the HTTP API reference has the full detail. [Problem types](https://on.auto/problems/) lists every type.

## Sitemap

See the [full documentation and product sitemap](https://on.auto/sitemap.md) for related pages.