PodSaid
Skip to main content

origin_denied — this site isn’t in your key’s allowlist

What happened

Every pk_live_ key ships with an exact-match origin allowlist so that even if the key value leaks (it’s in your HTML — it will leak), only pages served from the domains you approved can use it. The page making the request is on a domain we haven’t seen before for this key.

Fix

  1. Open your browser’s DevTools → Network tab, click the failing api.podsaid.com request, and read the Origin request header. That’s the exact string we need to allowlist.
  2. In Console → Settings → Allowed Origins, click Add and paste the full origin — scheme included (https://yourchurch.org, not yourchurch.org).
  3. www vs apex counts as different origins. If your site serves both, add both.
  4. For a staging domain (staging.yourchurch.org) or a preview URL from your host, add each one you want to test on.
  5. Browser extensions embed the widget with Origin: null. If that’s your use case, keep Allow browser extensions toggled on for this key (it’s on by default).

Related