Allow an origin
Add an origin to the calling key pair's allowlist. It is reduced to its canonical form (lowercase scheme and host, port only when non-default, no path or trailing slash), so https://Shop.example.com/cart is stored as https://shop.example.com. List every variant you serve from — www and apex, staging — as separate entries. A key may list at most 50 origins.
Takes effect on the next request.
Authorization
secretKey Secret key (server-side only), sent as Authorization: Bearer sk_…. This is the higher API-key tier: it satisfies routes requiring either the pk or sk tier. On pk-level routes no Origin header is required, and any forwarded Origin is ignored. The secret key satisfies the API-key tier only; it does not bypass visitor-token requirements, instance scoping, quotas or metering, or any other route-specific authorization. Routes requiring the sk tier remain secret-key-only, including administrative surfaces such as SKU alias registration, the origin allowlist, usage, and visitor deletion.
In: header
Request Body
application/json
TypeScript Definitions
Use the request body type in TypeScript.
Response Body
application/json
application/json
application/problem+json
application/problem+json
application/problem+json
application/problem+json
curl -X POST "https://example.com/origins" \ -H "Content-Type: application/json" \ -d '{ "origin": "https://shop.example.com" }'{ "origin": "string"}