---
id: "9d040caf-080e-45a9-8f80-d357a34c0c31"
name: "Direct Context API Cookies"
micro_summary: "Discarded: a cross-origin context POST with browser credentials returned 401; use the authenticated UI or an intentionally token-backed API."
status: "discarded"
see_also: []
scope: "Test whether an authenticated app.circleci.com browser session can create an organization context by POSTing to the CircleCI v2 context API using browser credentials and no API token."
discard_reason: "Cross-origin context POST with browser credentials returned 401; no-token direct API creation was not authenticated."
---
## Probe

An authenticated CircleCI app page issued a page-context POST to `https://circleci.com/api/v2/context` with JSON, `Content-Type: application/json`, and `credentials: 'include'`.

## Result

The endpoint returned `401` with `{"message":"You must log in first"}`. Browser authentication on `app.circleci.com` did not authenticate this cross-origin direct API write without a token. This rules out only the no-token cookie recipe. It does not rule out the CircleCI API with an intentionally provisioned API token. The successful fallback was the authenticated Contexts UI.