title: iconfinder api: systematic `Origin header does not match`
body: <p>I am trying to use iconfinder's api (v3). My goal is basically to reproduce their <a href="http://iconfinder.github.io/api-demo/public/" rel="nofollow noreferrer">demo application</a>.</p>
  
  <p>I am stuck at properly authenticating a request using JWT.</p>
  
  <p>According to <a href="https://developer.iconfinder.com/#json-web-token" rel="nofollow noreferrer">the docs</a> I need to generate an access token on my backend, then use it in my javascript as Authorization header in my api request.</p>
  
  <p>I successfully generate an access token in backend, and I use it in javascript to query the api.</p>
  
  <p>However I systematically get a 401 response:</p>
  
  <p><code>{"code":"unauthorized","message":"Origin header does not match"}</code></p>
  
  <p>In the devtools I see the headers sent with my GET request:</p>
  
  <pre><code>Accept: application/json, text/plain, */*
  Authorization: JWT eyJ0eXAiOiAiSldUIiwgImFsZyI6ICJIUzI1NiJ9.eyJzdWIiOiA0NTcsICJleHAiOiAxNTQzNDI2NzczLCAiaXNzIjogImljb25maW5kZXIuY29tIiwgImlhdCI6IDE1NDM0MjYxNzN9.9YZfCmHZLaOEqVzUcn1DKipWRL4j0CunpnQd4QRvieY=
  Origin: http://localhost:8081
  Referer: http://localhost:8081/
  User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/69.0.3497.81 Safari/537.36
  </code></pre>
  
  <p>The headers looked ok to me.<br>
  I also know my token is not 100% garbage because I get a different error if I use a wrong access token.  </p>
  
  <p>I figured this was because I had misconfigured my iconfinder api application:</p>
  
  <p><a href="https://i.stack.imgur.com/WDfQI.png" rel="nofollow noreferrer"><img src="https://i.stack.imgur.com/WDfQI.png" alt="configuration for my iconfinder api application"></a></p>
  
  <p>Now I tried a lot of things for the <code>domain restriction regex</code> in these settings, including:</p>
  
  <ul>
  <li><code>$http://localhost:8081^</code></li>
  <li><code>$http://localhost:8081/^</code></li>
  <li><code>*</code></li>
  <li><code>.*</code></li>
  <li><code>$http://127.0.0.1:8081/^</code></li>
  <li><code>$http://127.0.0.1:8081^</code></li>
  <li>A number of irrationale attempts :).</li>
  </ul>
  
  <p>The documentation on iconfinder's api (that I know about) is not very comprehensive.  </p>
  
  <p><strong>What is wrong in my application configuration or in my request?</strong></p>
  
  <p>Any help would be much appreciated!</p>