Skip to main content
GET
Get SDK origins

Concepts

The connection SDK resolves { success: false } without saying why. In practice it fails through two very different paths, and this endpoint solves the first one.

Failure 1 — origin not allowed

The SDK only works from domains registered in allowOrigins. If the browser origin is not on the list, it aborts with:
Use this endpoint before calling the SDK to find out whether the current origin is allowed:
The Omni Z-API dashboard domain is always accepted, even when it is not in allowOrigins. You only need to register your domains — including http://localhost:3000 for development.
Registering origins is done in the dashboard, under Security. There is no public endpoint for it.

Failure 2 — popup blocked

The SDK opens a window with window.open. If you call client.connect() after an await, the user gesture is already lost and the browser blocks the popup — the SDK also returns { success: false }.

Authentication

This is the only endpoint that accepts the Public Key, and it goes raw in the header — no Bearer:
That is intentional: the endpoint is called from the frontend, where the Public Key may be exposed.

Authorizations

Authorization
string
header
required

Path Parameters

channelId
string
required

Channel ID

Example:

"019E4C54B1B375A28970B605CA9B03C3"

Response

Channel origins

allowOrigins
string[]

Origins allowed for the SDK