HTTP 403 · type invalid_request_error · retryable false

defaultMessage API keys must not be used from a browser. Call /v1 from your server.

browser_origin_forbidden

Requests that include a browser Origin header are rejected.

What to do

1. Move all /v1 calls to your backend (Node, Python, Go, etc.).
2. Never embed X-Tecron-Secret in frontend bundles or mobile apps that ship to customers.
3. If a proxy or CDN injects Origin, strip it before the request reaches Tecron, or call from a server that does not send Origin.
4. Use the dashboard JWT APIs for interactive browser workflows — not public API keys.