Allowed Origins Explained

An origin is the combination of scheme, host and port that a web page is served from, for example https://shop.example.com. UPCS uses allowed origins to make sure your embed session can only be used on sites you have approved.

Where origins are managed

Origins are managed in the partner panel, which you reach after creating a partner account at /partner. You add the origin there and send the same value in the origin field when your server creates a session.

Rules to remember

• Origins must use https in production.
• For development, http://localhost:5173 works; see local development with localhost.
• The origin has no path: https://shop.example.com, not https://shop.example.com/checkout.
• The value sent when creating the session must match a registered origin.
• Removing an origin or disabling the key immediately stops sessions that depend on it.

Why it exists

Without a restriction, anyone who copied a session token could embed the map elsewhere. Binding the session to an approved origin limits that exposure. Your API key stays on your server, and the browser only holds a short-lived token.

Common failures

403 origin_not_allowed means the origin in your request is not registered. Check for these mistakes:

1. http versus https.
2. www.example.com versus example.com.
3. A missing or different port.
4. A trailing slash or path.
5. A staging domain that was never added.

A 422 validation error appears when the value is not a valid origin at all. Origins are matched in lower case and a trailing slash is ignored.

Multiple environments

Production, staging and local development each have their own origin. Register each one deliberately and remove staging entries when they are retired. Pair this with good key hygiene as described in securing your UPCS API key, and see the error codes reference for the exact response bodies.