inkeep · amikofalvy · Mar 30, 2026 · Mar 30, 2026 · Mar 30, 2026 · Mar 30, 2026
diff --git a/.changeset/better-origin-error.md b/.changeset/better-origin-error.md
@@ -0,0 +1,5 @@
+---
+"@inkeep/agents-api": patch
+---
+
+Return 403 Forbidden with "Origin not allowed for this app" when origin validation fails, instead of misleading 401 "Invalid Token"
diff --git a/agents-api/src/__tests__/run/middleware/app-credential-auth.test.ts b/agents-api/src/__tests__/run/middleware/app-credential-auth.test.ts
@@ -34,33 +34,37 @@ const { getAnonJwtSecretMock } = vi.hoisted(() => ({
   getAnonJwtSecretMock: vi.fn().mockReturnValue(new TextEncoder().encode('test-anon-secret')),
 }));
 
-vi.mock('@inkeep/agents-core', () => ({
-  validateAndGetApiKey: validateAndGetApiKeyMock,
-  getAppById: getAppByIdMock,
-  validateOrigin: validateOriginMock,
-  updateAppLastUsed: updateAppLastUsedMock,
-  verifyServiceToken: verifyServiceTokenMock,
-  isSlackUserToken: isSlackUserTokenMock,
-  verifySlackUserToken: verifySlackUserTokenMock,
-  verifyTempToken: verifyTempTokenMock,
-  canUseProjectStrict: canUseProjectStrictMock,
-  validateTargetAgent: validateTargetAgentMock,
-  verifyPoW: verifyPoWMock,
-  getPoWErrorMessage: (error: string) => {
-    const messages: Record<string, string> = {
-      pow_expired: 'Proof-of-work challenge has expired. Please request a new challenge.',
-      pow_required: 'Proof-of-work challenge solution is required.',
-      pow_invalid: 'Proof-of-work challenge solution is invalid.',
-    };
-    return messages[error] ?? 'Unknown PoW error';
-  },
-  getLogger: () => ({
-    debug: vi.fn(),
-    error: vi.fn(),
-    info: vi.fn(),
-    warn: vi.fn(),
-  }),
-}));
+vi.mock('@inkeep/agents-core', async () => {
+  const actual = await vi.importActual<typeof import('@inkeep/agents-core')>('@inkeep/agents-core');
+  return {
+    createApiError: actual.createApiError,
+    validateAndGetApiKey: validateAndGetApiKeyMock,
+    getAppById: getAppByIdMock,
+    validateOrigin: validateOriginMock,
+    updateAppLastUsed: updateAppLastUsedMock,
+    verifyServiceToken: verifyServiceTokenMock,
+    isSlackUserToken: isSlackUserTokenMock,
+    verifySlackUserToken: verifySlackUserTokenMock,
+    verifyTempToken: verifyTempTokenMock,
+    canUseProjectStrict: canUseProjectStrictMock,
+    validateTargetAgent: validateTargetAgentMock,
+    verifyPoW: verifyPoWMock,
+    getPoWErrorMessage: (error: string) => {
+      const messages: Record<string, string> = {
+        pow_expired: 'Proof-of-work challenge has expired. Please request a new challenge.',
+        pow_required: 'Proof-of-work challenge solution is required.',
+        pow_invalid: 'Proof-of-work challenge solution is invalid.',
+      };
+      return messages[error] ?? 'Unknown PoW error';
+    },
+    getLogger: () => ({
+      debug: vi.fn(),
+      error: vi.fn(),
+      info: vi.fn(),
+      warn: vi.fn(),
+    }),
+  };
+});
 
 vi.mock('jose', () => ({
   jwtVerify: jwtVerifyMock,
@@ -189,9 +193,10 @@ describe('App Credential Authentication', () => {
         },
       });
 
-      expect(res.status).toBe(401);
-      const body = await res.text();
-      expect(body).toContain('Invalid Token');
+      expect(res.status).toBe(403);
+      const body = await res.json();
+      expect(body.code).toBe('forbidden');
+      expect(body.detail).toBe('Origin not allowed for this app');
     });
 
     it('should reject when JWT app claim does not match', async () => {

diff --git a/agents-api/src/middleware/runAuth.ts b/agents-api/src/middleware/runAuth.ts
@@ -610,7 +610,7 @@ async function tryAppCredentialAuth(reqData: RequestData): Promise<AuthAttempt>
         { origin, allowedDomains: config.webClient.allowedDomains, appId: app.id },
         'App credential auth: origin not allowed'
       );
-      return { authResult: null, failureMessage: 'Origin not allowed for this app' };
+      throw createApiError({ code: 'forbidden', message: 'Origin not allowed for this app' });
     }
 
     if (!bearerToken) {