# `ORIGIN_NOT_ALLOWED` This request must come from the Checkslip web app

Source: https://checkslip.com/en/problems/origin-not-allowed

- **HTTP status**: `403`
- **Credit**: No credit taken

## Meaning

A request that changes data on app.checkslip.com must carry the `Origin` header `https://app.checkslip.com`, so other sites cannot use your sign-in. The request was not passed on and no credit was used.

## Cause

The `Origin` header was missing or named another site.

## Fix

If you are calling from your own code, use an API key on `https://api.checkslip.com` instead of the web sign-in. If you see this in a browser, turn off any extension that removes the `Origin` header and try again.

## Example response

```
{
  "type": "https://checkslip.com/problems/origin-not-allowed",
  "title": "This request must come from the Checkslip web app",
  "status": 403,
  "instance": "01a18600-0000-7000-8000-000000000000",
  "code": "ORIGIN_NOT_ALLOWED"
}
```