Gone (410)

The hosted-flow token is expired or already used, or the page that opened it is on a site that is not in your allowed origins. Tokens are single-use with a 30-minute TTL, and every dead link answers this same way — expired, consumed, or never-existed are indistinguishable on purpose (a link found in a log or screenshot must not become an oracle).

The donor who opens such a link sees "This link can't be opened" and is asked to go back to where they started and open a new link — so your page should be able to create one.

What to do

• If the link was never opened, check GET /v1/allowed_origins first. A page on a site that is not in your allowed origins cannot open the flow: in the sandbox, a localhost port you did not register shows This link can't be opened; any other site shows the browser's blocked-frame page with a frame-ancestors error in the console. The link is not spent: if GET /v1/donor_sessions/{id} still says created, add the site with PUT /v1/allowed_origins and open the same url again. A new session would fail the same way.
• Otherwise, create a new donor_session and hand the donor the fresh url.
• Never store or reuse hosted-flow URLs; treat them as one-shot.
• A session whose link expired before anyone opened it emits partner_session.expired on your webhook and feed, but only once the session is read with GET /v1/donor_sessions/{id} or its link is opened after expires_at. Nothing sends it at the expiry time on its own. To re-send unopened links, read the session after expires_at and act on status: expired.