Forbidden Origin

What it means

A widget-scoped token was used from a page whose origin isn't on that token's allowlist.

This usually points at your integration's setup rather than anything the end user did. Show the end user a generic message like "Something went wrong on our end.", and log detail for your own debugging.

How to fix it

1. 1.

   The widget token's allowed origins don't include the domain the request came from.

   Add the page's origin to the token's allowed origins in Settings → API Tokens.

2. 2.

   Testing locally from a dev port, but the token only allows the production domain.

   Add http://localhost:{port} to the token's allowed origins while developing.

Where this happens

• POST/api/v0/feedback· Create a piece of feedback
• POST/api/v0/reactions· Submit a reaction