When making requests from a browser, the domain checking will be used even if you use a backend ticket. Probably you are making requests from a hostname that you did not allow.
This is the id of the model on the Geometry Backend System it is running on. When you make a session init call, you find this id in the response (property model.id).
Thank you @snabela , yes, I added now some new domains, like localhost
ok, understood for the modelId that will come in the response from the session init call.
I have some other issues now but opened new post for that, so to keep the topic focused
It would be super useful anyway to have a documentation like getting started with the APIs and show the process how to start, how to authenticate and then make some calls to some endpoints.