Verify Domain fails with error : "The security token included in the request is invalid."

[eelco2k]

Login -> create new project -> Settings -> Domains -> add Domain
try to add a domain in the input field. and press button: "Add Domain"

result: "Something went wrong!"

post request goes to: /domains
with a json { domain: "mydomain.com", projectId: "uuid-v4-random" }
and a "next_token" Cookie

with these request headers:

POST /domains HTTP/2
Host: plunk-api.mydomain.com
User-Agent: Mozilla/5.0 Gecko/20100101 Firefox/154.0
Accept: */*
Accept-Language: en-US;q=0.9,en;q=0.8
Accept-Encoding: gzip, deflate, br, zstd
Content-Type: application/json
X-Project-Id: 36ac68ff-7b12-49c8-adad-7104eff547f9
Content-Length: 73
Origin: https://mydomain.com
Alt-Used: plunk-api.mydomain.com
Connection: keep-alive
Cookie: next_token=eyJhbGciOiJIU<redacted>DIxMC1hM2FlLWE0OWQ1NWY2Nz<redacted>I6MTc4MzkzNzMyNiwiZXhw<redacted>NTQyMTI2fQ.nMPw-CRGRSBkHvqMkR<redacted>HpbRpMfqyBw
Sec-Fetch-Dest: empty
Sec-Fetch-Mode: cors
Sec-Fetch-Site: same-site
DNT: 1
Sec-GPC: 1
Priority: u=0
Pragma: no-cache
Cache-Control: no-cache
TE: trailers

response:
{ error "The security token included in the request is invalid." }

Environment

Docker-compose within Portainer

• Deployment type:
  • Self-hosted

If self-hosted, please provide relevant details (Docker, Kubernetes, bare metal, etc.):

Docker -> portainer -> docker-compose -> nginx reverse_proxy

Version verification

• I have confirmed this issue still exists on the latest commit (not the latest tag)

  • Commit SHA tested: sha256:8a5dafdc9a967c2007b944ccb8a7ffd1a2bf18f5e6f5725fd983d1953c18e97f

---

Checklist

Please confirm the following before submitting:

• I have searched existing issues to ensure this bug has not already been reported
• I have provided clear reproduction steps
• I have included all relevant environment details