# origin_not_allowed

That origin cannot be used.

## What it means

The origin URL is not one we will forward visitors to. We only proxy to public HTTPS origins, so a customer domain can never be used to reach a private network.

## Why it happens

- The URL is not `https://`, carries credentials, or has a path, query or fragment.
- It resolves to a private, loopback, link-local or reserved address, like `10.0.0.5` or `localhost`.
- It is an IP address, an Apexly host, or a hostname that is a domain of another app.

## What to do

1. Use the public HTTPS URL your app answers on, like `https://app.hireflow.com`.
2. No app yet? Use the [sandbox origin](/docs/guides/test-mode).

- [Open the dashboard](/app/domains)
- [All limits](/docs/limits-and-pricing)

## In the API

```
HTTP 422

{
  "error": {
    "code": "origin_not_allowed",
    "message": "That origin cannot be used.",
    "fix": "Use a public HTTPS origin that you control.",
    "docs": "https://apexly.dev/docs/errors/origin_not_allowed"
  }
}
```