List your key's allowed origins
The domain allowlist of the key pair making the call: the origins its publishable key may be used from. Secret key only — a publishable key can never read or change its own allowlist. Each key pair has its own list; other key pairs on your instance are never affected. Never cached.
Authorization
secretKey Secret key (server-side only), sent as Authorization: Bearer sk_…. This is the higher API-key tier: it satisfies routes requiring either the pk or sk tier. On pk-level routes no Origin header is required, and any forwarded Origin is ignored. The secret key satisfies the API-key tier only; it does not bypass visitor-token requirements, instance scoping, quotas or metering, or any other route-specific authorization. Routes requiring the sk tier remain secret-key-only, including administrative surfaces such as SKU alias registration, the origin allowlist, usage, and visitor deletion.
In: header
Response Body
application/json
application/problem+json
application/problem+json
curl -X GET "https://example.com/origins"{ "data": [ "https://shop.example.com" ]}