Skip to content
Keliplay Docs

Add an allowed origin

POST
/v1/tenant/allowed-origins
curl --request POST \
  --url https://api.keliplay.com/v1/tenant/allowed-origins \
  --header 'Authorization: Bearer <token>' \
  --header 'Content-Type: application/json' \
  --data '{ "origin": "https://www.example.com", "platform": "web" }'

Allows a website or app to embed your games.

For web, send an absolute https URL. Only its origin is kept, so https://www.example.com/promo is stored as https://www.example.com. Plain http is accepted only for local development addresses. For android and ios, send the app’s application id or bundle id, such as com.example.app; it is stored as android:com.example.app or ios:com.example.app, the value to mint client tokens with. One app id can be added for both platforms.

Adding an origin you already have returns it with 200.

Permission: origins.manage.

Authorizations

Section titled “Authorizations”

Request Bodyrequired

Section titled “Request Bodyrequired”
Media typeapplication/json
object
origin
required
string
>= 1 characters <= 253 characters
platform
string
default: web
Allowed values: web android ios
Example
{
  "origin": "https://www.example.com",
  "platform": "web"
}

Responses

Section titled “Responses”

200

Section titled “200”

The origin was already allowed. It is returned unchanged.

Media typeapplication/json
object
allowedOrigin
required
object
id
required
string
origin
required

A web origin, or an app as android:<application id> or ios:<bundle id>.

string
platform
required

react_native and flutter appear only on origins added before apps were registered by platform.

string
Allowed values: web android ios react_native flutter
createdAt
required
string format: date-time
Example
{
  "allowedOrigin": {
    "platform": "web"
  }
}

201

Section titled “201”

The new origin.

Media typeapplication/json
object
allowedOrigin
required
object
id
required
string
origin
required

A web origin, or an app as android:<application id> or ios:<bundle id>.

string
platform
required

react_native and flutter appear only on origins added before apps were registered by platform.

string
Allowed values: web android ios react_native flutter
createdAt
required
string format: date-time
Example
{
  "allowedOrigin": {
    "id": "0192f3a1-0000-7000-8000-0000000a0001",
    "origin": "https://www.example.com",
    "platform": "web",
    "createdAt": "2026-09-01T09:00:00.000Z"
  }
}

400

Section titled “400”

The request is not valid. details lists each field that failed, where there is one.

Media typeapplication/json
object
error
required
object
code
required

Stable and safe to branch on.

  • invalid_request (400): the request is not valid.
  • unauthorized (401): missing, malformed or revoked API key.
  • upgrade_required (402): not in your plan, or a plan limit is reached.
  • forbidden (403): the key lacks a permission, or the action is not allowed.
  • not_found (404): nothing with that id in your account.
  • conflict (409): clashes with the current state.
  • confirmation_required (409): repeat with confirm=true. Folder deletion only.
  • rate_limited (429): wait for Retry-After seconds.
  • internal_error (500) and service_unavailable (503): try again later.
string
Allowed values: invalid_request unauthorized upgrade_required forbidden not_found conflict confirmation_required rate_limited internal_error service_unavailable
message
required

Written for a person. May change; do not parse it.

string
details
One of:
Array<object>
object
path
required

The failing field, dot separated, such as prize.label.

string
message
required
string
Example
{
  "error": {
    "code": "invalid_request",
    "message": "Invalid request json.",
    "details": [
      {
        "path": "name",
        "message": "Too small, expected string to have >=1 characters"
      }
    ]
  }
}

401

Section titled “401”

The API key is missing, malformed or revoked.

Media typeapplication/json
object
error
required
object
code
required

Stable and safe to branch on.

  • invalid_request (400): the request is not valid.
  • unauthorized (401): missing, malformed or revoked API key.
  • upgrade_required (402): not in your plan, or a plan limit is reached.
  • forbidden (403): the key lacks a permission, or the action is not allowed.
  • not_found (404): nothing with that id in your account.
  • conflict (409): clashes with the current state.
  • confirmation_required (409): repeat with confirm=true. Folder deletion only.
  • rate_limited (429): wait for Retry-After seconds.
  • internal_error (500) and service_unavailable (503): try again later.
string
Allowed values: invalid_request unauthorized upgrade_required forbidden not_found conflict confirmation_required rate_limited internal_error service_unavailable
message
required

Written for a person. May change; do not parse it.

string
details
One of:
Array<object>
object
path
required

The failing field, dot separated, such as prize.label.

string
message
required
string
Example
{
  "error": {
    "code": "unauthorized",
    "message": "Invalid or revoked API key."
  }
}

403

Section titled “403”

The API key does not carry the permission this needs, or the request is not allowed.

Media typeapplication/json
object
error
required
object
code
required

Stable and safe to branch on.

  • invalid_request (400): the request is not valid.
  • unauthorized (401): missing, malformed or revoked API key.
  • upgrade_required (402): not in your plan, or a plan limit is reached.
  • forbidden (403): the key lacks a permission, or the action is not allowed.
  • not_found (404): nothing with that id in your account.
  • conflict (409): clashes with the current state.
  • confirmation_required (409): repeat with confirm=true. Folder deletion only.
  • rate_limited (429): wait for Retry-After seconds.
  • internal_error (500) and service_unavailable (503): try again later.
string
Allowed values: invalid_request unauthorized upgrade_required forbidden not_found conflict confirmation_required rate_limited internal_error service_unavailable
message
required

Written for a person. May change; do not parse it.

string
details
One of:
Array<object>
object
path
required

The failing field, dot separated, such as prize.label.

string
message
required
string
Example
{
  "error": {
    "code": "forbidden",
    "message": "Your role does not allow this (draws.run)."
  }
}

Product tour, pricing and demos: keliplay.com