Calling from a browser
Origin restrictions, and what they do and do not protect.
By default a key is refused if it arrives with an Origin header — that is, from browser JavaScript. Pasting a server key into front-end code should break loudly rather than quietly publish your credential.
If you do want to call the API directly from your website, register that site as an allowed origin when you create the key. We will then accept it from that origin and answer with the matching CORS headers.
What the origin allowlist actually protects
The
Origin header is set by the browser and cannot be forged by page JavaScript, so the allowlist genuinely stops somebody embedding a key scraped from your site into a page on their own domain. It is not a defence against a server-side caller — curl can send any origin it likes. A key shipped to a browser is readable by every visitor, so treat it as public: grant it devices:read and nothing more, and keep anything that switches hardware on your own backend.The pattern we would recommend for a customer-facing dashboard: hold a full-scope key on your server, expose your own endpoint that applies your own authorisation rules, and let the browser talk to that. Your users never see a Circuvent credential at all.