diff --git a/lib/streaming_providers/base/provider.py b/lib/streaming_providers/base/provider.py
index 5832732..55a0a96 100644
--- a/lib/streaming_providers/base/provider.py
+++ b/lib/streaming_providers/base/provider.py
@@ -24,6 +24,7 @@ from typing import ClassVar, Dict, List, Optional, Tuple
 from ..providers.auth import AuthContext, AuthStatus  # noqa: F401  (re-exported for callers)
 from .auth_type import AuthType  # noqa: F401  (re-exported for callers)
 from .models import DRMConfig, Event, StreamingChannel
+from .utils.logger import logger
 from .provider_mixins.auth import ProviderAuthMixin
 from .provider_mixins.bookmarks import ProviderBookmarksMixin
 from .provider_mixins.catchup import ProviderCatchupMixin
@@ -149,6 +150,7 @@ class StreamingProvider(
         """
         url = self.get_manifest(content_id, **kwargs)
         headers = self.get_manifest_headers(content_id, **kwargs)
+        logger.info(f"ALLENTE-DEBUG get_manifest_with_headers → url={url!r}, headers={headers!r}")
         return url, headers
 
     def get_dynamic_manifest_params(self, channel: StreamingChannel, **kwargs) -> Optional[str]:
diff --git a/lib/streaming_providers/providers/allente/provider.py b/lib/streaming_providers/providers/allente/provider.py
index 21b4a76..c2aba36 100644
--- a/lib/streaming_providers/providers/allente/provider.py
+++ b/lib/streaming_providers/providers/allente/provider.py
@@ -12,11 +12,11 @@ Public API (implemented here):
 
 Inherited from StreamingProvider (verified against base source — do not
 re-implement):
-  * get_manifest_with_headers() -> base default composes get_manifest() +
-                                   get_manifest_headers(); base
-                                   get_manifest_headers() returns {}, which
-                                   is correct for Allente (open CDN).
-  * get_segment_headers()       -> defaults to manifest headers ({}).
+  * get_manifest_headers() / get_segment_headers() → overridden to send
+                                   origin/referer/UA. Akamai's edge rejects
+                                   requests without them (Access Denied HTML page).
+                                   The response advertises access-control-allow-origin:
+                                    * for CORS, but the actual gate is enforced at the edge.
   * get_events()/EPG/VOD/etc.   -> mixin defaults (empty) — out of v1 scope.
   * to_output_format()/to_json()-> consume self.channels, populated by
                                    get_channels().