Rodolfo Perez
12/18/2025, 11:37 PMkapa.ai
12/18/2025, 11:37 PMallowed_origin to exactly match your frontend origin (including protocol and port, no trailing slash), for example: json { "workspace_name": "customer_workspace_123", "allowed_origin": "<http://localhost:3000>" } This value is passed when generating a widget token via the Embedded API and is used for CORS and origin validation.[[Widget token](https://docs.airbyte.com/ai-agents/embedded/api/authentication#generate-widget-token); [CORS origin](https://docs.airbyte.com/ai-agents/embedded/api/authentication#cors-and-origin-validation)] If your CORS error is about a generic React API (not the Airbyte Embedded widget/API), the knowledge sources don’t provide enough information to give a concrete fix.