Missing Host header. If you want to allow a hostname, run np

Error message

Missing Host header. If you want to allow a hostname, run npx paperclipai allowed-hostname <host>.

What it means

Error "Missing Host header. If you want to allow a hostname, run npx paperclipai allowed-hostname <host>." thrown in paperclipai/paperclip.

Source

Thrown at server/src/middleware/private-hostname-guard.ts:77

  bindHost: string;
}): RequestHandler {
  if (!opts.enabled) {
    return (_req, _res, next) => next();
  }

  const allowSet = resolvePrivateHostnameAllowSet({
    allowedHostnames: opts.allowedHostnames,
    bindHost: opts.bindHost,
  });

  return (req, res, next) => {
    const hostname = extractHostname(req);
    const wantsJson = req.path.startsWith("/api") || req.accepts(["json", "html", "text"]) === "json";

    if (!hostname) {
      const error = "Missing Host header. If you want to allow a hostname, run npx paperclipai allowed-hostname <host>.";
      if (wantsJson) {
        res.status(403).json({ error });
      } else {
        res.status(403).type("text/plain").send(error);
      }
      return;
    }

    if (isLoopbackHostname(hostname) || allowSet.has(hostname)) {
      next();
      return;
    }

    const error = BLOCKED_HOSTNAME_MESSAGE;
    if (wantsJson) {
      res.status(403).json({ error });
    } else {
      res.status(403).type("text/plain").send(error);
    }
  };

View on GitHub (pinned to 120ae5428f)

Solutions

Send requests with a Host header, or allow the hostname via npx paperclipai allowed-hostname <host>.

When it happens

Trigger: Thrown at server/src/middleware/private-hostname-guard.ts:77 when the library encounters an invalid state.

Common situations: See trigger scenarios.

AI-assisted analysis of paperclipai/paperclip@120ae5428f (2026-08-18). Data as JSON: /api/errors/3c69aa2f5aff7358. Report an issue: GitHub.