> ## Documentation Index
> Fetch the complete documentation index at: https://developer.omni.z-api.io/llms.txt
> Use this file to discover all available pages before exploring further.

# SDK origins

> Allow the domains that can call the connection SDK and diagnose silent failures

## Concepts

The connection SDK resolves `{ success: false }` **without saying why**. In practice it fails through two very different paths, and this endpoint solves the first one.

## Failure 1 — origin not allowed

The SDK only works from domains registered in `allowOrigins`. If the browser origin is not on the list, it aborts with:

```
[Omni Z-API SDK] Origin "https://app.yourcompany.com" is not in the allowed origins list.
```

Use this endpoint **before** calling the SDK to find out whether the current origin is allowed:

```javascript theme={null}
const info = await fetch(
  `https://api.omni.z-api.io/instances/${channelId}/sdk-info`,
  { headers: { Authorization: YOUR_PUBLIC_KEY } },
).then((r) => r.json());

const allowed = info.allowOrigins.includes(window.location.origin);
```

<Note>
  The Omni Z-API dashboard domain is always accepted, even when it is not in `allowOrigins`. You only need to register **your** domains — including `http://localhost:3000` for development.
</Note>

<Warning>
  Registering origins is done in the dashboard, under **Security**. There is no public endpoint for it.
</Warning>

## Failure 2 — popup blocked

The SDK opens a window with `window.open`. If you call `client.connect()` **after an `await`**, the user gesture is already lost and the browser blocks the popup — the SDK also returns `{ success: false }`.

```javascript theme={null}
// Wrong: the await consumes the click gesture
async function onClick() {
  const data = await loadSomething();
  await client.connect({ channelId });   // popup blocked
}

// Right: connect() is the first thing after the click
async function onClick() {
  const promise = client.connect({ channelId });
  const data = await loadSomething();
  await promise;
}
```

## Authentication

This is the **only** endpoint that accepts the Public Key, and it goes raw in the header — no `Bearer`:

```bash theme={null}
curl https://api.omni.z-api.io/instances/CHANNEL_ID/sdk-info \
  -H "Authorization: YOUR_PUBLIC_KEY"
```

That is intentional: the endpoint is called from the frontend, where the [Public Key may be exposed](/en/authentication).


## OpenAPI

````yaml en/channels/openapi-sdk-info.json GET /instances/{channelId}/sdk-info
openapi: 3.1.0
info:
  title: Omni Z-API - SDK info
  description: Query the origins allowed for the channel connection SDK
  version: 1.0.0
servers:
  - url: https://api.omni.z-api.io
security: []
paths:
  /instances/{channelId}/sdk-info:
    get:
      tags:
        - Channels
      summary: Get SDK origins
      description: >-
        Returns the origins allowed for that channel's connection SDK.


        Authenticated with the **Public Key** in the `Authorization` header —
        with no `Bearer` prefix. It is the only endpoint that accepts the Public
        Key, precisely so it can be called from the frontend.
      operationId: getSdkInfo
      parameters:
        - name: channelId
          in: path
          required: true
          description: Channel ID
          schema:
            type: string
            example: 019E4C54B1B375A28970B605CA9B03C3
      responses:
        '200':
          description: Channel origins
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/SdkInfo'
              example:
                allowOrigins:
                  - https://app.yourcompany.com
                  - http://localhost:3000
        '401':
          description: Invalid or missing Public Key
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/Error'
        '404':
          description: Channel not found
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/Error'
      security:
        - publicKey: []
components:
  schemas:
    SdkInfo:
      type: object
      properties:
        allowOrigins:
          type: array
          items:
            type: string
          description: Origins allowed for the SDK
    Error:
      type: object
      properties:
        error:
          type: integer
        message:
          type: string
  securitySchemes:
    publicKey:
      type: apiKey
      in: header
      name: Authorization

````