origin_allow_list

origin_allow_list restricts which Origin values a channel accepts, server-side.

Synopsis

{ "origin_allow_list": ["https://app.example.com", "https://admin.example.com"] }

Fields

Rules:

• A request whose Origin header is present and unlisted is refused 403 before the workflow runs.
• A request with no Origin header is not checked at all.
• Omitting the key checks nothing. origin_allow_list is the only accepted spelling.
• The check applies to the HTTP ingresses only — a Kafka record and a channel_call have no origin to check.

This is not CORS. It performs no handshake, sets no Access-Control-Allow-Origin, and takes no part in a preflight. The browser handshake is the platform [cors] layer’s job. The division of labor:

• [cors] governs the browser handshake. It short-circuits a genuine preflight from an unlisted origin, but a non-preflighted cross-origin request still runs server-side. The layer omits the response header and the browser discards the answer. Non-browser clients are unaffected entirely.
• origin_allow_list is the server-side check. It runs on every request that reaches the handler, browser or not, and stops the workflow from executing.

Neither is authentication: Origin is client-supplied, and any non-browser caller can set or omit it. For access control that holds against a hostile client, use auth.

Related

• CORS settings: the browser handshake, which this is not.
• Secure an instance: origin checks in context.
• auth: access control that holds against a hostile client.
• Channel configuration: every key, with its page.

Last verified 14 September 2026