{"record":{"id":"6ae145fc19cabaab","repo":"calcom/cal.diy","slug":"apiauthstrategy-access-token-invalid-request-o","errorCode":null,"errorMessage":"ApiAuthStrategy - access token - Invalid request origin - please open https://app.cal.com/settings/platform and add the origin '${origin}' to the 'Redirect uris' of your OAuth client with ID '${client.id}'","messagePattern":"ApiAuthStrategy - access token - Invalid request origin - please open https://app\\.cal\\.com/settings/platform and add the origin '(.+?)' to the 'Redirect uris' of your OAuth client with ID '(.+?)'","errorType":"http","errorClass":"UnauthorizedException","httpStatus":401,"severity":"error","filePath":"apps/api/v2/src/modules/auth/strategies/api-auth/api-auth.strategy.ts","lineNumber":275,"sourceCode":"\n    return user;\n  }\n\n  async accessTokenStrategy(accessToken: string, request: ApiAuthGuardRequest, origin?: string) {\n    const accessTokenValid = await this.oauthFlowService.validateAccessToken(accessToken);\n    if (!accessTokenValid) {\n      throw new UnauthorizedException(`ApiAuthStrategy - access token - ${INVALID_ACCESS_TOKEN}`);\n    }\n\n    const client = await this.tokensRepository.getAccessTokenClient(accessToken);\n    if (!client) {\n      throw new UnauthorizedException(\n        \"ApiAuthStrategy - access token - OAuth client not found given the access token\"\n      );\n    }\n\n    if (origin && !isOriginAllowed(origin, client.redirectUris)) {\n      throw new UnauthorizedException(\n        `ApiAuthStrategy - access token - Invalid request origin - please open https://app.cal.com/settings/platform and add the origin '${origin}' to the 'Redirect uris' of your OAuth client with ID '${client.id}'`\n      );\n    }\n\n    const ownerId = await this.tokensRepository.getAccessTokenOwnerId(accessToken);\n\n    if (!ownerId) {\n      throw new UnauthorizedException(\n        `ApiAuthStrategy - access token - ${INVALID_ACCESS_TOKEN}. No owner found for this access token.`\n      );\n    }\n\n    const user: UserWithProfile | null = await this.userRepository.findByIdWithProfile(ownerId);\n    if (!user) {\n      throw new UnauthorizedException(\n        \"ApiAuthStrategy - access token - User associated with the access token not found.\"\n      );\n    }","sourceCodeStart":257,"sourceCodeEnd":293,"githubUrl":"https://github.com/calcom/cal.diy/blob/176037d0afbe572f870a3c702985e7cd83fe6c0c/apps/api/v2/src/modules/auth/strategies/api-auth/api-auth.strategy.ts#L257-L293","documentation":"Thrown by accessTokenStrategy when the request carries an Origin header that isOriginAllowed() rejects against the OAuth client's redirectUris list. Cal.com enforces CORS/origin allow-listing per OAuth client: only origins registered in the client's Redirect URIs may use an access token. The message helpfully embeds the offending origin and the client id so the operator can fix the config.","triggerScenarios":"A browser/spa client at https://staging.myapp.com calls /v2 with a Cal.com access token, but only https://myapp.com is listed in that OAuth client's Redirect URIs. Any cross-origin XHR/fetch from an unregistered host triggers it.","commonSituations":"Adding a new deployment domain (preview branch, staging, localhost dev), forgetting to add it to the platform OAuth client; scheme change (http -> https) treated as a new origin; trailing slash or port mismatch in the registered URI.","solutions":["Open https://app.cal.com/settings/platform and add the exact origin (scheme+host+port, no trailing slash) shown in the error to the OAuth client's Redirect URis.","If using a proxy, send requests from a registered server-side origin instead of directly from the browser.","Double-check scheme/port: `http://localhost:3000` and `https://localhost:3000` are distinct origins."],"exampleFix":null,"handlingStrategy":"validation","validationCode":"const allowed = await listClientRedirectUris(clientId);\nconst origin = new URL(requestOrigin).origin;\nif (!allowed.includes(origin)) {\n  throw new Error(`Add origin ${origin} to the OAuth client's Redirect URIs in Platform settings`);\n}","typeGuard":null,"tryCatchPattern":null,"preventionTips":["Register every deployment origin (incl. preview/staging/localhost with port) in the OAuth client's Redirect URIs.","Make server-to-server calls from a fixed, registered origin to bypass browser CORS constraints.","Treat scheme and port as part of the origin — http vs https and :80 vs :443 are distinct."],"tags":["auth","oauth","cors","origin","platform"],"backgroundTag":null,"analyzedSha":"176037d0afbe572f870a3c702985e7cd83fe6c0c","analyzedAt":"2026-08-12T19:12:41.464Z","schemaVersion":2},"datasetVersion":"2026-08-12T23:17:12.415Z"}