403

This endpoint is not accessible via browser.

`,\n { status: 403, headers: { \"Content-Type\": \"text/html\" } },\n );\n }\n\n // 2. CORS preflight\n if (req.method === \"OPTIONS\") {\n if (allowedOrigin && allowedOrigin !== \"*\" && origin !== allowedOrigin) {\n return new Response(null, { status: 403 });\n }\n return new Response(null, {\n status: 204,\n headers: {\n \"Access-Control-Allow-Origin\": allowedOrigin || origin,\n \"Access-Control-Allow-Headers\": \"x-api-key, Content-Type\",\n \"Access-Control-Max-Age\": \"86400\",\n },\n });\n }\n\n // 3. Check Origin header\n if (allowedOrigin && allowedOrigin !== \"*\" && origin !== allowedOrigin) {\n return new Response(\n JSON.stringify({ error: \"Origin not allowed\" }),\n { status: 403, headers: { \"Content-Type\": \"application/json\" } },\n );\n }\n\n // 4. Validate API key\n if (!secret) {\n return new Response(\n JSON.stringify({ error: \"API_SECRET not configured on server\" }),\n { status: 500, headers: corsHeaders(allowedOrigin || origin) },\n );\n }\n if (apiKey !== secret) {\n return new Response(\n JSON.stringify({ error: \"Unauthorised\" }),\n { status: 401, headers: corsHeaders(allowedOrigin || origin) },\n );\n }\n\n // 5. Check GAS URL is configured\n if (!gasUrl) {\n return new Response(\n JSON.stringify({ error: \"GAS_API_URL not configured on server\" }),\n { status: 500, headers: corsHeaders(allowedOrigin || origin) },\n );\n }\n\n // 6. Fetch from Google Sheets\n try {\n const res = await fetch(`${gasUrl}&t=${Date.now()}`, {\n redirect: \"follow\",\n });\n if (!res.ok) throw new Error(`GAS returned HTTP ${res.status}`);\n const json = await res.json();\n return new Response(\n JSON.stringify(json),\n { status: 200, headers: corsHeaders(allowedOrigin || origin) },\n );\n } catch (err) {\n return new Response(\n JSON.stringify({\n error: \"Sheet fetch failed: \" + (err as Error).message,\n }),\n { status: 502, headers: corsHeaders(allowedOrigin || origin) },\n );\n }\n}\n\nfunction corsHeaders(origin: string): Record {\n return {\n \"Access-Control-Allow-Origin\": origin,\n \"Access-Control-Allow-Headers\": \"x-api-key, Content-Type\",\n \"Content-Type\": \"application/json\",\n \"X-Content-Type-Options\": \"nosniff\",\n \"Cache-Control\": \"no-store\",\n };\n}","deleted","label","children",[],[160],"files",[158],"counts",{"_183":33,"_184":185,"_186":33,"_187":188,"_192":193},"pulls","branches",1,"forks","envVars",{"_189":190,"_191":33},"count",3,"emptyCount","connections",{"_189":33,"_194":33},"unfilledCount","contents",[197],{"_106":159,"_99":160,"_161":162,"_163":-5,"_164":146,"_165":145,"_166":167,"_108":198,"_103":169,"_170":171,"_172":173,"_174":22,"_175":-5,"_102":199},["D",1774083314290],[160],"file","upstreamProject","upstreamBranch","emptyEnvVars","isNew","flags",[],"routes/_app.x.$handle.$name.environment-variables",{"_97":98,"_99":100,"_104":209,"_187":214,"_232":22},{"_106":107,"_99":100,"_108":210,"_110":-5,"_111":22,"_112":113,"_114":-5,"_115":-5,"_14":116,"_117":-5,"_118":22,"_119":-5,"_120":-5,"_121":33,"_16":122,"_123":-5,"_124":-5,"_125":-5,"_126":127,"_128":127,"_129":130,"_131":130,"_132":130,"_133":127,"_134":127,"_23":211,"_138":212,"_143":213,"_155":22},["D",1773786079286],{"_97":98,"_136":137},{"_97":98,"_140":137,"_14":116,"_141":142},{"_103":145,"_99":45,"_106":146,"_147":107,"_148":-5,"_149":-5,"_150":-5,"_151":-5,"_152":-5,"_153":100,"_154":98},[215,223,227],{"_216":217,"_108":218,"_219":220,"_114":221,"_222":22},"key","GAS_API_URL",["D",1774076262076],"updatedAt",["D",1774079298651],"WEBAPP FROM APP SCRIPT","isEmpty",{"_216":224,"_108":225,"_219":-5,"_114":226,"_222":22},"API_SECRET",["D",1774075949603],"TOKEN",{"_216":228,"_108":229,"_219":230,"_114":231,"_222":22},"SLACK_WEBHOOK_URL",["D",1773787245044],["D",1774075539879],"netlifyurl","isTeamOrg","actionData","errors"]

Key	Description
GAS_API_URL	WEBAPP FROM APP SCRIPT
API_SECRET	TOKEN
SLACK_WEBHOOK_URL	netlifyurl

Afritrack

Afritrack2026reportingplatform

Environment variables