# Forbidden origin

Resolve forbidden origin errors.

The request was made from a browser and the `Origin` header value is not whitelisted in the application's [trusted origins](/explanation/application/trusted-origins).

[Add the origin](/explanation/application/trusted-origins#add-trusted-origins) to the application's trusted origins before retrying.

## Response

All error responses follow the [Problem Details (RFC 9457)](/reference/api/overview#errors) format. The `type`, `title`, `status`, and `detail` fields are always present, while `instance` may be omitted depending on the API.

Here is an example of the response returned for this error:

```json
{
  "type": "https://croct.help/api/authentication/forbidden-origin",
  "title": "The request origin is not allowed.",
  "status": 403,
  "detail": "The origin of the request is not authorized to access this resource.",
  "instance": "/client/web/content"
}
```