api=http://localhost:3001
origin=http://localhost:3000
jar=$(mktemp)

curl -sS -c "$jar" -X POST "$api/api/auth/sign-up/email" \
  -H "Content-Type: application/json" \
  -H "Origin: $origin" \
  -d '{"name":"Local Owner","email":"owner@example.com","password":"replace-this-password"}'

curl -sS -b "$jar" -X POST "$api/api/auth/api-key/create" \
  -H "Content-Type: application/json" \
  -H "Origin: $origin" \
  -d '{"name":"cli"}'

const response = await fetch("http://localhost:3001/api/auth/api-key/create", {
  method: "POST",
  credentials: "include",
  headers: { "Content-Type": "application/json" },
  body: JSON.stringify({ name: "cli" }),
});

{
  "id": "key_example",
  "name": "cli",
  "start": "ftrv_example1",
  "key": "ftrv_example_key_shown_once"
}

{
  "error": {
    "code": "FORBIDDEN",
    "message": "This request origin is not allowed."
  }
}