The Origin Allow-List of api.onepassapps.com: Two Allowed Origins, One Fixed Preflight and Per-Route Rate Limits
I work on OnePassApps, so this is our own product, and everything below is a measurement of our own build, taken today from outside the browser with no session and no cookies. On 4 November 2026 between about 22:17 and 22:27 UTC I read the cross-origin contract of the API host behind app.onepassapps.com: which origins it answers, what its preflight says, and how its rate limits differ from route…
According to a measurement taken on November 4, 2026 between 10:17 PM and 10:27 PM UTC, the API host behind app.onepassapps.com allows cross-origin GET requests from only two specific origins: https://app.onepassapps.com and https://api.onepassapps.com. All other origins received no access-control-allow-origin header. The preflight OPTIONS request received a 204 response with the same headers for all routes, regardless of the requested method.
The preflight cache duration is set to 600 seconds (ten minutes). The varying Vary header differs across routes, but all routes share the same rate limits: 120 requests per minute with a concurrency limit of 64 for most routes, except /api/voting which has a concurrency limit of 64. The app.host, in contrast, allows all origins to access the app shell with fetch.
Written by urgent.news from Dev.to's reporting — not their text. Machine-written — may contain errors; check the original before relying on it.
