{"record":{"id":"a278b18cfd517f9b","repo":"n8n-io/n8n","slug":"this-instance-url-is-not-in-your-allowed-origins-l","errorCode":null,"errorMessage":"This instance URL is not in your allowed origins list. Open Settings and add its origin, or use a deeplink from your trusted n8n.","messagePattern":"This instance URL is not in your allowed origins list\\. Open Settings and add its origin, or use a deeplink from your trusted n8n\\.","errorType":"validation","errorClass":null,"httpStatus":null,"severity":"error","filePath":"packages/@n8n/local-gateway/src/main/connect-origin.ts","lineNumber":15,"sourceCode":"import { isOriginAllowed } from '@n8n/computer-use/config';\n\n/**\n * Throws if the normalized instance URL's origin is not allowed by the configured patterns.\n * Call before constructing GatewayClient (deep link / IPC connect).\n */\nexport function assertConnectOriginAllowed(url: string, allowedOriginPatterns: string[]): void {\n\tlet origin: string;\n\ttry {\n\t\torigin = new URL(url.replace(/\\/$/, '')).origin;\n\t} catch {\n\t\tthrow new Error('Invalid instance URL.');\n\t}\n\tif (!isOriginAllowed(origin, allowedOriginPatterns)) {\n\t\tthrow new Error(\n\t\t\t'This instance URL is not in your allowed origins list. Open Settings and add its origin, or use a deeplink from your trusted n8n.',\n\t\t);\n\t}\n}\n","sourceCodeStart":1,"sourceCodeEnd":20,"githubUrl":"https://github.com/n8n-io/n8n/blob/5ac6606e81f67bb9534255570cd4e86fd8101eee/packages/@n8n/local-gateway/src/main/connect-origin.ts#L1-L20","documentation":"Thrown by assertConnectOriginAllowed when the URL parsed successfully but its origin does not match any pattern in allowedOriginPatterns (checked via isOriginAllowed from @n8n/computer-use/config). This is the allowlist guard that prevents the local gateway daemon from connecting to an untrusted n8n instance. The message directs the user to Settings to add the origin or use a trusted deep link.","triggerScenarios":"Calling assertConnectOriginAllowed(url, allowedOriginPatterns) where the URL's origin (scheme + host + port) is not matched by any pattern in the user's configured allowedOrigins list in the gateway settings store.","commonSituations":"User pasted a deep link from a different n8n instance than the one they trust; the instance moved to a new domain/port and the allowlist is stale; user is on a fresh gateway install with an empty allowedOrigins; the origin pattern uses a different scheme (http vs https) than the URL.","solutions":["Open the n8n Gateway Settings UI and add the instance origin (scheme + host + port, e.g. 'https://acme.n8n.cloud') to the allowed origins list.","Connect from the trusted n8n instance using its computer-use deep link instead of pasting a URL manually.","Verify the origin pattern matches the scheme — 'https://acme.com' will not match 'http://acme.com'.","If using wildcard patterns, confirm the wildcard syntax matches what isOriginAllowed expects."],"exampleFix":"// before — origin not in allowlist\nassertConnectOriginAllowed('https://new.n8n.cloud', allowed);\n// throws\n\n// after — add the origin to settings first\nsettingsStore.update({ allowedOrigins: [...allowed, 'https://new.n8n.cloud'] });\nassertConnectOriginAllowed('https://new.n8n.cloud', settingsStore.get().allowedOrigins);","handlingStrategy":"validation","validationCode":"import { isOriginAllowed } from '@n8n/computer-use/config';\n\nfunction isOriginPermitted(url: string, patterns: string[]): boolean {\n  try {\n    const origin = new URL(url.replace(/\\/$/, '')).origin;\n    return isOriginAllowed(origin, patterns);\n  } catch {\n    return false;\n  }\n}","typeGuard":"function isAllowedOrigin(url: string, patterns: string[]): boolean {\n  try { return isOriginPermitted(url, patterns); } catch { return false; }\n}","tryCatchPattern":null,"preventionTips":["Pre-check the origin against settings.allowedOrigins before opening a deep link.","When the instance domain changes, update the allowlist in Settings proactively.","Match the scheme exactly — http vs https origins are distinct."],"tags":["local-gateway","security","allowlist","origin","deeplink"],"backgroundTag":null,"analyzedSha":"5ac6606e81f67bb9534255570cd4e86fd8101eee","analyzedAt":"2026-08-12T05:26:35.080Z","schemaVersion":2},"datasetVersion":"2026-08-13T04:17:16.726Z"}