Remove an allowed origin
Remove an origin from the calling key pair's allowlist. The origin is passed as a query parameter rather than in the path, because an encoded // in a path is not reliably preserved by proxies. Browser requests from it are refused with origin_not_allowed from the next request.
Authorization
secretKey Secret key (server-side only), sent as Authorization: Bearer sk_…. This is the higher API-key tier: it satisfies routes requiring either the pk or sk tier. On pk-level routes no Origin header is required, and any forwarded Origin is ignored. The secret key satisfies the API-key tier only; it does not bypass visitor-token requirements, instance scoping, quotas or metering, or any other route-specific authorization. Routes requiring the sk tier remain secret-key-only, including administrative surfaces such as SKU alias registration, the origin allowlist, usage, and visitor deletion.
In: header
Query Parameters
The origin to remove, in any form that canonicalises to a listed entry.
Response Body
application/problem+json
application/problem+json
application/problem+json
application/problem+json
application/problem+json
curl -X DELETE "https://example.com/origins?origin=https%3A%2F%2Fshop.example.com"