> For the complete documentation index, see [llms.txt](https://docs.january.ai/llms.txt). Markdown versions of documentation pages are available by appending `.md` to page URLs; this page is available as [Markdown](https://docs.january.ai/client-sdks/web-sdk/concepts/runtime-boundaries.md).

# Runtime and security boundaries

{% hint style="danger" %}
**A browser can call January only from origins January has enabled for your account.** January rejects the CORS preflight from any other origin, so the request never reaches the API. Send your January contact the exact scheme, host, and port of every origin you use, for example `https://app.example.com` and `http://localhost:5173`. Until they're enabled, make January calls from your server.
{% endhint %}

| Where the code runs                                         | Package                                                                                                                                                                                | Credential                                                                                              |
| ----------------------------------------------------------- | -------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- | ------------------------------------------------------------------------------------------------------- |
| Browser, on an origin January has enabled                   | `@januaryai/web-sdk`                                                                                                                                                                   | Client token from your [token endpoint](/client-sdks/web-sdk/getting-started/backend-token-endpoint.md) |
| Browser, origin not enabled                                 | `@januaryai/web-sdk` only for `FoodPortion`, `preparePhotoScanImage`, `VoiceCaptureSession`, and types; API calls go to your server                                                    | None                                                                                                    |
| Your server (route handler, server action, server function) | `@januaryai/web-sdk` with a client token your server mints, as the [React example](/client-sdks/web-sdk/getting-started/example-app.md) does; or `@januaryai/server` with your API key | API key, in a server environment variable only                                                          |

When your server makes the January calls, your browser code calls your own routes, and your server applies the same session checks it uses for the token endpoint.

The API key never goes to the browser, in any form. A request that fails because of the origin looks like a network error; see [Troubleshooting](/client-sdks/web-sdk/reference/troubleshooting.md#browser-request-fails-during-cors-preflight).