Fixes › Deploys

CORS error: blocked by CORS policy: No 'Access-Control-Allow-Origin' header

CursorReplitBoltv0

The error

Access to fetch at 'https://api...' from origin 'https://...' has been blocked by CORS policy

Why it happens

The browser blocks cross-origin requests unless the server answers with Access-Control-Allow-Origin for your site (and handles the OPTIONS preflight). Many third-party APIs deliberately don't allow browser calls because they need a secret key.

How to fix it

1. If it's your API: return Access-Control-Allow-Origin for your exact domain and handle OPTIONS.
2. If it's a third-party API with a secret key: call it from your own server route instead.
3. Don't use public CORS proxies for anything with keys.

Fix prompt (paste into Lovable, Bolt, Cursor, Replit or v0)

Requests to <API> fail with a CORS error in the browser. If the API is ours, add CORS headers for <MY_ORIGIN> only and handle OPTIONS preflight. If it's a third-party API, move the call to a server-side API route that the frontend calls, keeping any key server-side.

FAQ

Why does it work in Postman?

CORS is enforced by browsers only.

Can I use Access-Control-Allow-Origin: *?

Only for public, credential-free endpoints.

Related fixes

• Vercel build fails: Type error / ESLint errors (works locally)
• 404 NOT_FOUND when refreshing a page (React/Vite SPA)
• Replit deploy: app not reachable / port not open
• Hydration failed because the server rendered HTML didn't match the client