diff --git a/python/api/csrf_token.py b/python/api/csrf_token.py
index 37bb8453a..0e46a4d46 100644
--- a/python/api/csrf_token.py
+++ b/python/api/csrf_token.py
@@ -29,7 +29,7 @@ class GetCsrfToken(ApiHandler):
         if not origin_check["ok"]:
             return {
                 "ok": False,
-                "error": f"Origin {self.get_origin_from_request(request)} not allowed when login is disabled. Set login and password or add your URL to ALLOWED_ORIGINS env variable. Currently allowed origins: {",".join(origin_check['allowed_origins'])}",
+                "error": f"Origin {self.get_origin_from_request(request)} not allowed when login is disabled. Set login and password or add your URL to ALLOWED_ORIGINS env variable. Currently allowed origins: {','.join(origin_check['allowed_origins'])}",
             }
 
         # generate a csrf token if it doesn't exist