Fix UPCS Error 403 origin_not_allowed

The origin_not_allowed error (HTTP 403) means the website asking for an embedded map is not on the list of allowed origins for your API key.

Symptom

Creating an embed session fails, or the map does not load, and the response has success: false with the code origin_not_allowed.

Likely causes

• The origin was never added in the partner panel.
• The registered origin is slightly different: www versus no www, http versus https, or a different subdomain.
• The origin was removed, which immediately stops sessions that depend on it.
• The origin value sent when creating the session does not match the site where the map is shown.

Fix it step by step

1. Look at the address bar of the page that shows the map. Note the scheme and host exactly, for example https://shop.example.com.
2. In the partner panel, find the Allowed origins card, enter that exact value under Add an origin and choose Add origin. Use https only.
3. Make sure your server sends the same value in the origin field when it calls POST /v1/embed/sessions.
4. If you use both example.com and www.example.com, register both.
5. For local development, register http://localhost:5173 if that is the address you use.
6. Create a new session and reload the page.

Confirm it is fixed

The map loads and you can select a point to receive a code. If the origin is accepted but you see an invalid value message, read validation errors.

When to contact support

If the origin is registered exactly and the error continues, contact support with the origin string you registered and the origin you send.