CORS

A browser blocks calls from app.example.com to api.example.com unless the API allows that origin. CORS is off by default. Server code, scripts and agents do not need it.

Turn it on

Variable	Default	What it does
CORS_ENABLED	false	true allows the origins below.
CORS_ORIGINS	unset	Exact origins, comma-separated, such as https://app.example.com,http://localhost:5173. No wildcards, no paths.

Fine-tune

The defaults fit most apps. Change them only when your app needs more.

Variable	Default	What it does
CORS_METHODS	GET,POST,PUT,PATCH,DELETE	HTTP methods the browser may use.
CORS_HEADERS	Authorization,Content-Type,If-Match,If-None-Match,X-Request-ID,X-Workspace-ID	Request headers the browser may send.
CORS_EXPOSE_HEADERS	ETag,X-Request-ID,X-Response-Time,Retry-After,Content-Disposition	Response headers your code can read.
CORS_MAX_AGE	10m	How long the browser caches the preflight check.

You can also manage CORS in Settings → Security, where changes apply without a restart. A variable that is set wins over Studio and shows as read-only there, even when it equals the default.

Note: Cross-origin requests must use a bearer token. Cookies are never allowed across origins, and sign-in (POST /api/v1/auth/login) from another origin returns 403 access_denied. Get the token on your own server, or use a personal token.

Next steps

• Authenticate a client
• Try the API playground