403 Origin not allowed

Your publishable key was used from a page whose origin is not on its allowlist.

This is the most common error, and it is working as intended. Publishable keys are public — they sit in your page source where anyone can read them. The origin allowlist is what actually protects the key, exactly like a Google Maps JS key or a Stripe publishable key. Without it, anyone could copy your key and spend your quota.

Fix it

The error body tells you the origin we rejected and the exact page to add it on:

{
  "error": {
    "code": "origin_not_allowed",
    "message": "Origin \"https://shop.example.com\" is not allowed for key ig_pk_3lSd…. Currently allowed: https://example.com. Add \"https://shop.example.com\" to the allowlist at https://app.instantgeo.info/projects/prj_abc123#keys and it will take effect within 30 seconds.",
    "rejectedOrigin": "https://shop.example.com"
  }
}

Copy the rejectedOrigin value verbatim into the allowlist. Changes propagate within 30 seconds.

Common causes

www and apex are different origins. https://example.com does not cover https://www.example.com. Add both, or use *.example.com plus the apex.

A staging or preview domain. Vercel and Netlify preview URLs change per deploy. Use a wildcard for the preview subdomain, or a separate key.

http versus https. If you wrote https://example.com in the allowlist, a page served over plain http will not match. Leave the scheme off to allow both.

You do not need to add localhost. localhost and 127.0.0.1 are always allowed on any port, so local development works without configuring anything.

Allowlist syntax

Entry	Matches
example.com	http://example.com and https://example.com, any port
https://example.com	only over https
example.com:8443	only that port
*.example.com	app.example.com, www.example.com — one level only

*.example.com does not match the apex example.com, and does not match a.b.example.com. Multi-level wildcards are how a stale allowlist entry turns into “anyone who can get a subdomain can spend your quota”.