What CORS headers does my API need?

At minimum: Access-Control-Allow-Origin. For authenticated requests: also Access-Control-Allow-Credentials: true with an explicit origin (not *). For non-simple requests: also Access-Control-Allow-Methods and Access-Control-Allow-Headers in the OPTIONS preflight response.

Can I use * for Access-Control-Allow-Origin?

Only for fully public APIs with no authentication. If your API uses cookies, Authorization headers, or any credentials, you must specify an explicit origin.

Do I need to handle OPTIONS separately?

Yes for POST, PUT, DELETE, and requests with custom headers. The browser sends OPTIONS first. Your server must return 204 with CORS headers for the actual request to run.

Generator

CORS Header Generator

Select your configuration and get the exact CORS headers for your API — with copy-paste config for every major stack.

Test your CORS config with a live preflight → CORSFixer