This instance URL is not in your allowed origins list. Open

Error message

This instance URL is not in your allowed origins list. Open Settings and add its origin, or use a deeplink from your trusted n8n.

What it means

Thrown by assertConnectOriginAllowed when the URL parsed successfully but its origin does not match any pattern in allowedOriginPatterns (checked via isOriginAllowed from @n8n/computer-use/config). This is the allowlist guard that prevents the local gateway daemon from connecting to an untrusted n8n instance. The message directs the user to Settings to add the origin or use a trusted deep link.

Source

Thrown at packages/@n8n/local-gateway/src/main/connect-origin.ts:15

import { isOriginAllowed } from '@n8n/computer-use/config';

/**
 * Throws if the normalized instance URL's origin is not allowed by the configured patterns.
 * Call before constructing GatewayClient (deep link / IPC connect).
 */
export function assertConnectOriginAllowed(url: string, allowedOriginPatterns: string[]): void {
	let origin: string;
	try {
		origin = new URL(url.replace(/\/$/, '')).origin;
	} catch {
		throw new Error('Invalid instance URL.');
	}
	if (!isOriginAllowed(origin, allowedOriginPatterns)) {
		throw new Error(
			'This instance URL is not in your allowed origins list. Open Settings and add its origin, or use a deeplink from your trusted n8n.',
		);
	}
}

View on GitHub (pinned to 5ac6606e81)

Solutions

Open the n8n Gateway Settings UI and add the instance origin (scheme + host + port, e.g. 'https://acme.n8n.cloud') to the allowed origins list.
Connect from the trusted n8n instance using its computer-use deep link instead of pasting a URL manually.
Verify the origin pattern matches the scheme — 'https://acme.com' will not match 'http://acme.com'.
If using wildcard patterns, confirm the wildcard syntax matches what isOriginAllowed expects.

Example fix

// before — origin not in allowlist
assertConnectOriginAllowed('https://new.n8n.cloud', allowed);
// throws

// after — add the origin to settings first
settingsStore.update({ allowedOrigins: [...allowed, 'https://new.n8n.cloud'] });
assertConnectOriginAllowed('https://new.n8n.cloud', settingsStore.get().allowedOrigins);

Defensive patterns

Strategy: validation

Validate before calling

import { isOriginAllowed } from '@n8n/computer-use/config';

function isOriginPermitted(url: string, patterns: string[]): boolean {
  try {
    const origin = new URL(url.replace(/\/$/, '')).origin;
    return isOriginAllowed(origin, patterns);
  } catch {
    return false;
  }
}

Type guard

function isAllowedOrigin(url: string, patterns: string[]): boolean {
  try { return isOriginPermitted(url, patterns); } catch { return false; }
}

Prevention

Pre-check the origin against settings.allowedOrigins before opening a deep link.
When the instance domain changes, update the allowlist in Settings proactively.
Match the scheme exactly — http vs https origins are distinct.

When it happens

Trigger: Calling assertConnectOriginAllowed(url, allowedOriginPatterns) where the URL's origin (scheme + host + port) is not matched by any pattern in the user's configured allowedOrigins list in the gateway settings store.

Common situations: User pasted a deep link from a different n8n instance than the one they trust; the instance moved to a new domain/port and the allowlist is stale; user is on a fresh gateway install with an empty allowedOrigins; the origin pattern uses a different scheme (http vs https) than the URL.

Related errors

AI-assisted analysis of n8n-io/n8n@5ac6606e81 (2026-08-12). Data as JSON: /api/errors/a278b18cfd517f9b. Report an issue: GitHub.