Verify the mount

Run these against your own domain, not the tenant host. The samples use https://www.example.com and the site id site_example.

1. The site configuration

curl -i https://www.example.com/edgekit/v1/id/config \
  -H 'x-edgekit-site-id: site_example'

A working mount answers 200 with content-type: application/json and a JSON body with a methods list. This route needs no credential and does not check origins, so it tests the routing alone.

Answer	Meaning
Your own site’s 404 page, or other HTML	The rule does not forward `/edgekit/v1/*`
`400` `bad_request`, `Missing site id.`	The `x-edgekit-site-id` header did not reach EdgeKit. Your forwarder drops it
`404` `not_found`, `Unknown site.`	The id is wrong, the site is disabled, or the site has not been deployed
`200` with the text `edgekit.cloud alive`	The request reached the tenant host on a path it does not serve. Check the forwarded path

2. Decide and the origin check

curl -i https://www.example.com/edgekit/v1/decide \
  -H 'content-type: application/json' \
  -H 'x-edgekit-site-id: site_example' \
  -H 'origin: https://www.example.com' \
  --data '{"features":["mount-check"]}'

A working mount answers 200 with access-control-allow-origin: https://www.example.com and a body that lists mount-check under unknown. A feature name your deployment does not carry is reported, not evaluated, so this request moves no meter.

Answer	Meaning
`401` `unauthorized`, `Missing API key.`	The forwarder removed `/edgekit` from the path. `/v1/decide` takes an API key
`403` `forbidden`, `This origin is not allowed for the selected site.`	The origin is not in the site’s Allowed origins, or the list was changed and not deployed
`503` `service_unavailable`, `This tenant has no deployed configuration.`	Decide has no deployed configuration for your organization. See Troubleshooting
`429` `too_many_requests`	The rate limit. Wait for the `Retry-After` seconds

3. The same checks in TypeScript

For Node 18 or later. Browsers do not let a page set Origin.

const site = 'https://www.example.com';
const siteId = 'site_example';

const config = await fetch(`${site}/edgekit/v1/id/config`, {
  headers: { 'x-edgekit-site-id': siteId },
});

console.log(config.status, config.headers.get('content-type'));

const decide = await fetch(`${site}/edgekit/v1/decide`, {
  method: 'POST',
  headers: {
    'content-type': 'application/json',
    'x-edgekit-site-id': siteId,
    origin: site,
  },
  body: JSON.stringify({ features: ['mount-check'] }),
});

console.log(
  decide.status,
  decide.headers.get('access-control-allow-origin'),
  await decide.text(),
);

4. In a browser

Open a page that uses EdgeKit, with the browser’s developer tools on the network panel.

EdgeKit requests go to your own origin under /edgekit/, with no preflight OPTIONS request before them.
After a user signs in, the sign-in cookies are listed under your site’s host. Their names contain ek..
The tracker’s request to /edgekit/a/t answers 200 with the body ok. A body of edgekit.cloud alive means the forwarder kept the /edgekit prefix on an analytics path. See Route the paths.