Ctrl+Z Therapy
CasesQuick answersGuides10-minute checklistHow we testCartoonSend it in

CORS error when your app calls an API? Why the browser blocks it

Ship ItChecked against the official source

Source checked 8 Oct 2026 · Published 23 Oct 2026 · Last reviewed 23 Oct 2026 · By Ctrl+Z Therapy (how we test)

The short answer

For security reasons, browsers restrict cross-origin HTTP requests initiated from scripts. A page can only read a response from another domain if that server allows it with the Access-Control-Allow-Origin header. That's why most CORS errors can only be fixed on the server, because the server controls whether cross-origin access is allowed.

What to do

  1. Your own server or Supabase Edge Function? Add the CORS headers and handle the preflight (OPTIONS) request.
  2. Someone else's API that doesn't allow browsers? You can't fix that from your page. Call it from a server or function you control and return the result.
  3. Bonus: calling the API from your own function also keeps your API key out of the browser.

Good to know

  • Don't rely on mode: no-cors, which makes the response unreadable, or on public CORS proxies.

Source

Checked on 8 Oct 2026. Prices, limits and settings change, so check the source before you rely on them.

Related