CORS Header Not Allowed — Fix

Your request includes a custom header (Authorization, Content-Type: application/json, or similar) that your server's OPTIONS preflight response does not allow. Add it to Access-Control-Allow-Headers.

The fix — allow the header in your preflight response

Express

app.use(cors({
  origin: 'https://app.example.com',
  allowedHeaders: ['Content-Type', 'Authorization', 'X-Custom-Header'],
}));

Nginx

if ($request_method = OPTIONS) {
    add_header Access-Control-Allow-Headers "Authorization, Content-Type, X-Custom-Header";
    return 204;
}

FastAPI

app.add_middleware(CORSMiddleware,
  allow_origins=["https://app.example.com"],
  allow_headers=["Authorization", "Content-Type"]
)

Allow all headers (development only)

# Not for production — allows any header
add_header Access-Control-Allow-Headers "*";

Use CORSFixer to send a real preflight to your API — it shows the exact headers the browser is requesting and what your server is allowing.