badges/shields · error · InvalidParameter

requested origin not authorized

Error message

requested origin not authorized

What it means

_withAnyAuth is the shared pipeline for all auth helpers; after enforceStrictSsl it checks `shouldAuthenticateRequest(requestParams)`. If authentication is marked required (`this.isRequired`) but the request's origin is not in the authorized-origin allowlist, authentication would silently be skipped for a service that must always authenticate — so it throws InvalidParameter 'requested origin not authorized'.

Source

Thrown at core/base-service/auth-helper.js:136

    return this.isConfigured && !originViolation && !strictSslCheckViolation
  }

  get _basicAuth() {
    const { _user: username, _pass: password } = this
    return this.isConfigured
      ? { username: username || '', password: password || '' }
      : undefined
  }

  /*
   * Helper function for `withBasicAuth()` and friends.
   */
  _withAnyAuth(requestParams, mergeAuthFn) {
    this.enforceStrictSsl(requestParams)

    const shouldAuthenticate = this.shouldAuthenticateRequest(requestParams)
    if (this.isRequired && !shouldAuthenticate) {
      throw new InvalidParameter({
        prettyMessage: 'requested origin not authorized',
      })
    }

    return shouldAuthenticate ? mergeAuthFn(requestParams) : requestParams
  }

  static _mergeAuth(requestParams, auth) {
    const { options, ...rest } = requestParams
    return {
      options: {
        ...auth,
        ...options,
      },
      ...rest,
    }
  }

View on GitHub (pinned to 766fd8bc89)

Solutions

1. Make the request origin exactly match an authorized origin string (scheme + host), e.g. use https://api.github.com if that is what is allowlisted
2. Fix the service's `_authorizedOrigins` (via the `authorizedOrigins` config option) to include the actual origin you are calling
3. Check protocol and port: http://host and https://host are different origins; include the port in the configured origin if non-default
4. If the request is meant to be unauthenticated, configure the service so auth is not required

Example fix

// before (service configured with authorizedOrigins: ['https://example.com'])
const params = service.withBasicAuth({ url: 'https://api.example.com/v2/status' })
// after
service._authorizedOrigins.push('https://api.example.com') // or call the allowlisted origin
const params = service.withBasicAuth({ url: 'https://example.com/v2/status' })

function assertOriginAuthorized(url, authorizedOrigins) {
  const { protocol, host } = new URL(url)
  const origin = `${protocol}//${host}`
  if (!authorizedOrigins.includes(origin)) {
    throw new Error(`requested origin not authorized: ${origin} not in ${authorizedOrigins.join(', ')}`)
  }
}
assertOriginAuthorized(requestParams.url, service._authorizedOrigins)

function isAuthorizedOrigin(url, authorizedOrigins = []) {
  try {
    const { protocol, host } = new URL(url)
    return authorizedOrigins.includes(`${protocol}//${host}`)
  } catch { return false }
}

try {
  const params = service.withApiKeyHeader(requestParams)
} catch (err) {
  if (err.prettyMessage === 'requested origin not authorized') {
    console.error(`Origin ${new URL(requestParams.url).origin} missing from authorizedOrigins`)
  } else throw err
}

When it happens

Trigger: Calling withBasicAuth/withApiKeyHeader/withBearerAuthHeader/withQueryStringAuth/withJwtAuth with a target URL whose `${protocol}//${host}` origin is not listed in the service's `_authorizedOrigins`, while the service is configured with auth required (e.g. `auth: { user, pass }` plus a domain allowlist mismatch).

Common situations: Redirecting credentials to a different subdomain or mirror (http vs https counts as a different origin); a service whose authorizedOrigins config uses 'example.com' but the request goes to 'https://api.example.com'; trailing-slash/port mismatches in configured origins.

Related errors

• strict ssl is required
• invalid url parameter
• please use https
• domain is blocked
• invalid response data from auth endpoint

AI-assisted analysis of badges/shields@766fd8bc89 (2026-08-30). Data as JSON: /api/errors/c554fc867d8e138a. Report an issue: GitHub.