Manage Allowed Origins for Your UPCS Key

An allowed origin is the exact address of a website that is permitted to display the UPCS embedded map with your key. If the origin of a session request is not on the list, UPCS refuses it. This protects your key from being used on sites you do not control.

What an origin looks like

An origin is the scheme and host, with no path: https://shop.example.com. The scheme matters, so https://example.com and https://www.example.com are different origins and each needs its own entry.

Add an origin

1. Sign in to the partner panel.
2. Find the Allowed origins card.
3. In the Add an origin field, enter the full https origin of your site, for example https://shop.example.com.
4. Choose Add origin. Changes apply immediately.

Use localhost for development

For local work, register http://localhost:5173. This is the plain http address meant for development; live sites must use https.

Change or remove an origin

To change an address (for instance after moving to a new domain), use the pencil icon on its row, or add the new origin first, confirm the map loads, then remove the old one with the bin icon. Removing an origin immediately stops any sessions that depend on it, so do it when you are sure the old site no longer needs it.

Troubleshooting

If the map fails with origin_not_allowed (HTTP 403):

1. Check that the origin you send when you create a map session matches the registered value exactly, including www and the port.
2. Confirm the origin is listed in the Allowed origins card of the same partner account that owns the key.
3. Make sure the key is active; a disabled key returns a 401 "Invalid or inactive API key" instead. See the error codes.

The plugins use the same kind of key as custom code, so the same checks on the key apply when a plugin's map does not load.