origin_invalid

When it happens

The Frontend API takes writes (POST, PATCH, DELETE) and CORS preflights only from the instance’s allowed origins. These are the instance’s own host, the origins listed in its settings, and:

• on a production instance, every https origin on your domain or one of its subdomains;
• on a development instance, localhost and 127.0.0.1 (a request without an Origin is accepted there too).

The request came from a page whose origin is none of them. A session token is minted only for a request with an allowed Origin, which becomes the token’s azp claim.

What to do

Serve your app from your own domain, or add its origin (for example https://app.example.net) to the instance’s allowed origins in the dashboard (Auth settings, Allowed origins).