CORS and origins
Neuroon validates the Origin of each request differently depending on the endpoint. This page is the single source of truth.
Canonical matrix (Integrations API)
| Endpoint | Auth | Accepts absent Origin (server-to-server) |
|---|---|---|
POST /api/integrations/v1/products/sync | Authorization: Bearer <api-key> | Yes |
GET /api/integrations/v1/products | Authorization: Bearer <api-key> | Yes |
POST /api/integrations/v1/conversions | Authorization: Bearer <api-key> | Yes |
GET /api/integrations/v1/shop | Authorization: Bearer <api-key> | Yes |
Calls to
/api/integrations/*are server-to-server. If a browserOriginis detected that doesn't match the registered domain, the backend may reject the request. Use these APIs from your server, not the browser.
Typical errors
| Code | Cause | Fix |
|---|---|---|
401 Unauthorized | Invalid or missing API Key | Check the Authorization: Bearer <api-key> header |
403 Forbidden | Origin doesn't match the registered domain | Add the domain in the dashboard |