Skip to content
CCS Chat Docs

Register web origins

Goal

Section titled “Goal”

Let a browser app on your origin call the Chat API. You list the origin once, on your application’s SPA client at the Identity Server. Chat reads it from there. There is nothing to configure on the Chat side.

Prerequisites

Section titled “Prerequisites”
  • A SPA client on your tenant application. It already needs this entry for its own calls to /oauth/token, so it may be there.
  • The exact origin of your web app, for example https://fitness.example.com.

Steps

Section titled “Steps”

  1. Open the SPA client. In the Identity Server admin UI, open Clients, pick your tenant application, then your SPA client, and choose Edit.

  2. Add the origin to Allowed Origins. Use the exact scheme://host[:port]: no path, no trailing slash and no wildcard. For local work, http://localhost:<port> is accepted only on a development application.

  3. Save and wait. A new origin works in Chat within about a minute.

Chat then admits that origin on the routes of your application, and on tenant-level presence and push device registration. It answers browser requests without credentials: your app authenticates with a bearer token in the Authorization header, never with a cookie. Allowed headers are Content-Type and Authorization, and Retry-After is readable on 429 responses.

Verify

Section titled “Verify”

Send a preflight request from your origin to a route of your application.

Terminal window
curl -i -X OPTIONS "$CHAT_API_URL/tenants/$CCS_TENANT_ID/applications/$CCS_APPLICATION_ID/me/capabilities" \
  -H "Origin: https://fitness.example.com" \
  -H "Access-Control-Request-Method: GET" \
  -H "Access-Control-Request-Headers: authorization"

A registered origin gets an Access-Control-Allow-Origin header that echoes it. An origin that is not registered gets no such header, and the browser blocks the call.

Troubleshooting

Section titled “Troubleshooting”
Symptom Cause and fix
The browser reports a CORS error The origin is not on a client of this application, or the value differs from the page’s origin (scheme, host or port). Compare them character by character.
It worked a minute ago, then stopped The client was disabled, the origin was removed, or Chat was switched off for the application.
A new origin still fails Wait about a minute.
Calls to /me or /admin fail from your app Those routes are for Chat’s own web app. Use the routes under /tenants/{tenant_id}/applications/{application_id}/.
CORS passes but the call answers 403 That is not CORS. Check the token’s context; see Troubleshooting.
Section titled “Related”