Origin server
The real machine your content actually lives on. The CDN is a crowd of copies; the origin is the one that can answer when they cannot.
See it
What it is
The origin is the one place a response can be produced for real: your app server, a storage bucket, a static host, sometimes another CDN. Everything the edge serves is a photocopy of something the origin made. When an edge location has no valid copy, it does an 'origin fetch' and pays the full trip back to wherever your origin lives.
Because of that, origin traffic is the number worth watching. A 95 percent hit ratio means your origin only sees one request in twenty, and can be a small box. Drop to 60 percent and the same traffic becomes an eight-times heavier load. Origin shield (a designated mid-tier cache that all PoPs fetch through) is the standard fix for a busy site.
Gotcha: most origins stay publicly reachable by IP after the CDN goes in front, so anyone who finds that address can bypass your caching, your rate limits, and your DDoS protection entirely. Lock the origin to the CDN, with a shared secret header, mutual TLS, or a firewall rule allowing only the provider's address ranges.
Ask AI for it
Configure the CDN in front of this app and lock the origin down. Set the origin to the app's internal hostname, forward the Host and X-Forwarded-For headers, and require a shared secret header on every origin request so direct hits are rejected with 403. Add a firewall rule allowing inbound traffic only from the CDN's published IP ranges, enable origin shield so edge locations fetch through one mid-tier cache, and add a health check endpoint the CDN can probe.