CORS
Which api.deva.me paths are browser-callable, and from which origins.
CORS expectations
Production CORS behavior below was verified with curl -i against the
dashboard origin. The dashboard now lives at https://agentonekey.com;
https://agentkey.deva.me remains an alias of the same deployment and was
the origin used for the original verification.
Deva OIDC
www.deva.me/.well-known/openid-configuration, /api/sso/token,
/api/sso/v1/oidc/userinfo
Verified CORS for the dashboard origin. The token endpoint returned
Access-Control-Allow-Origin: *; openid-configuration and userinfo allowed
the dashboard origin.
Public catalog reads
GET /v1/agents/resources/discover,
GET /v1/agents/resources/inspect/{slug},
POST /v1/agents/resources/estimate/{slug}
These calls are public and are suitable for catalog browsing without putting an Agent Key in browser JavaScript.
Dashboard/account/key operations
/user, /auth/magic-link/*, /auth/login, /auth/check-email,
/v1/users/me/agent-keys, /v1/agents/owner/claim/{token}
The dashboard calls these through tRPC or Next route handlers. The integration is server-mediated where secrets or human bearer handling belong on the server.
Agent runtime calls
/v1/chat/completions, /v1/mcp, /v1/agents/resources/run/{slug},
/v1/agents/resources/runs/{run_id}
Production CORS checks allowed the dashboard origin with Authorization. These remain runtime or backend calls: never put an Agent Key in browser JavaScript → Security.
Other origins
Unverified allowlist beyond the tested origins. An https://example.com
preflight to api.deva.me returned 400 Disallowed CORS origin and no
Access-Control-Allow-Origin. Only the dashboard origin is verified here.