> ## Documentation Index
> Fetch the complete documentation index at: https://docs.nestapi.com/llms.txt
> Use this file to discover all available pages before exploring further.

# Add an allowed origin to an API key

> Add an allowed origin to an API key



## OpenAPI

````yaml /openapi.json post /apikeys/{KeyId}/origins
openapi: 3.0.0
info:
  title: NestAPI
  version: '1.0'
servers:
  - url: https://api.nestapi.com
    description: Production
security: []
tags:
  - name: account
    description: API key and account management
  - name: admin
  - name: ApiAdmin
  - name: auth
  - name: billing
  - name: fairness
    description: >-
      Per-customer nesting-minutes fairness config, weights and usage (requires
      an Admin API key)
  - name: importer
  - name: nesting
    description: Submit nesting jobs, retrieve results and exports
  - name: plan
  - name: proxy
  - name: public
    description: Health check and public utility endpoints
  - name: subscriptionstatus
paths:
  /apikeys/{KeyId}/origins:
    parameters:
      - $ref: '#/components/parameters/Accept'
    post:
      tags:
        - account
      summary: Add an allowed origin to an API key
      description: Add an allowed origin to an API key
      operationId: AddKeyAllowedOrigin
      parameters:
        - name: KeyId
          in: path
          required: true
          schema:
            type: string
        - name: Origin
          in: query
          schema:
            type: string
      requestBody:
        content:
          application/json:
            schema:
              $ref: '#/components/schemas/AddKeyAllowedOrigin'
      responses:
        '200':
          description: The key's allowed origins, including the one just added.
          content:
            application/json:
              schema:
                title: List<String>
                type: array
                items:
                  type: string
        '400':
          description: The origin is missing or not a valid absolute origin.
          content:
            application/json:
              schema:
                title: List<String>
                type: array
                items:
                  type: string
        '401':
          description: API key is missing or invalid.
          content:
            application/json:
              schema:
                title: List<String>
                type: array
                items:
                  type: string
      deprecated: false
      security:
        - Bearer: []
components:
  parameters:
    Accept:
      name: Accept
      in: header
      description: Accept Header
      required: true
      schema:
        type: string
        enum:
          - application/json
  schemas:
    AddKeyAllowedOrigin:
      title: AddKeyAllowedOrigin
      properties:
        KeyId:
          type: string
        Origin:
          type: string
      description: >-
        Add an allowed browser Origin (CORS) to an API key. Provide a full
        absolute origin — scheme, host and (non-default) port — e.g.
        https://app.example.com. Origins are matched exactly, so register each
        distinct origin you call the API from. For local development, add your
        dev server's localhost origin (e.g. http://localhost:3000); the scheme
        and port must match exactly (http://localhost:3000 is different from
        https://localhost:3000 and from http://localhost:5173). KeyId comes from
        the route; Origin is the body.
      type: object
  securitySchemes:
    Bearer:
      type: apiKey
      name: Authorization
      in: header

````