# live_key_not_allowed_in_browser

- HTTP status: 403
- Retry: No
- Execution: not started
- Admin needed: no

**Live key used from a browser.** Requests that carry an `Origin` header come from browser code, where a key is visible to anyone who opens the page. Live keys are refused there; test keys are allowed from origins the workspace has approved.

## What it means

The API returns HTTP 403 with `error.code` set to `live_key_not_allowed_in_browser`. The default message is: "Live API keys cannot be used from a browser. Use a test key, or call the API from your server."

## Common causes

- A live key was used from front-end code or a browser-based API playground.

## How to identify it

Check the response status (`403`) and `error.code` (`live_key_not_allowed_in_browser`). Branch on `error.code`, not on the message text: messages can be reworded, codes do not change within v1. Log `error.request_id` (also sent as the `X-Request-Id` header) so support can find the request.

## How to fix it

- Move live calls to your server.
- Use a `rai_test_` key in browser-based tools.

## Retry guidance

Sending the request unchanged fails the same way. Fix the cause first (see How to fix it), then send it again.

## Did anything happen?

This request was refused before any call was placed and before anything was charged.

## Idempotency

Nothing was done and nothing was stored (under an Idempotency-Key, if you sent one), so the request can be sent again, with the same key if you used one, once the cause is fixed.

## Who can fix it

The developer who sends the request can fix it; no administrator action is normally needed.

## When to contact support

If the error persists after the steps above, contact [support@relationsai.com](mailto:support@relationsai.com). See [Support](/resources/support) for what to include (the `request_id`, the time in UTC, the operation, and whether you used a test or live key) and what never to send (API keys, Authorization headers, webhook signing secrets, recording links, transcripts or customer data).

## Example error response

```json
{
  "error": {
    "code": "live_key_not_allowed_in_browser",
    "message": "Live API keys cannot be used from a browser. Use a test key, or call the API from your server.",
    "details": {},
    "request_id": "req_qq2kulb7nkgbm75x75nhowfu",
    "retry": "no",
    "doc_url": "https://docs.relationsai.com/errors/live_key_not_allowed_in_browser"
  }
}
```

## Incorrect and corrected request

Incorrect: A live key sent from browser code (the request carries an Origin header).

```http
GET /v1/workspace
Authorization: Bearer rai_live_YOUR_LIVE_KEY
Origin: https://www.example.com
```

Corrected: From the browser, use a test key (from an origin the workspace allows); make live calls from your server.

```http
GET /v1/workspace
Authorization: Bearer rai_test_YOUR_TEST_KEY
Origin: https://www.example.com
```

See all codes in the [error-code reference](/fundamentals/error-codes).