PricingCompare CORS proxies

cors.dev vs corsproxy.dev

corsproxy.dev Pro and cors.dev Pro both cost $5 per month, though corsproxy.dev counts requests and bandwidth per day and needs an API key on every plan, including its free plan of 500 requests per day. cors.dev needs no key or signup for public GET and HEAD requests, so moving a GET call means a new base URL and no key.

Official pages checked 18 October 2026.

corsproxy.dev Pro

$5 / month

Requests: 20,000 per day, reset at 00:00 UTC
Bandwidth: 10 GB per day
Methods: GET and POST; PUT, PATCH and DELETE are not supported
Size & types: 10 MB request body and 10 MB response; executable files are refused
Headers: reqHeaders and resHeaders overrides, up to 20; managed upstream headers add a stored secret
Caching: Edge cache with ttl from 1 to 86,400 seconds
API key: Required on every plan: key= in browser URLs, X-API-Key from servers
Free option: 500 requests and 250 MB per day, after email signup
Self-hosting: Separate MIT-licensed Go relay; keys and quotas off by default; not the hosted code

View corsproxy.dev homepage and plans

cors.dev Pro

$5 / month

Plus tax where applicable.

Requests: 500,000 per monthly billing period
Throughput: 600 requests per minute and 10 concurrent requests per account; shared service limits also apply
Targets: Public HTTPS hostnames on port 443
Size & time: 1 MiB request body, 6 MiB response, 10 seconds
Methods: GET, HEAD, POST, PUT, PATCH and DELETE
Headers: Custom headers and explicit Authorization; no browser cookies or secret vault
Caching: Opt-in GET caching, 1 to 300 seconds. Eligible public responses only; cache hits count.

Check managed availability in your account. Free access is available now.

Create account

Migrate from corsproxy.dev: change the base URL, drop the key

corsproxy.dev takes a percent-encoded target at https://api.corsproxy.dev/proxy?url= with your key in key= or an X-API-Key header. cors.dev reads ?url= on / and /raw only, so /proxy?url= is rejected with HTTP 400: use https://proxy.cors.dev/?url= with the same encoded target and remove the key, since GET and HEAD to public APIs need none. Parameters after a percent-encoded target, such as key, ttl and reqHeaders, are ignored. POST and custom headers need managed access, where an origin-locked publishable key goes in X-Cors-Key and is never sent upstream.

corsproxy.dev to cors.dev

// Before: corsproxy.dev, API key plus a percent-encoded target
const target = encodeURIComponent('https://api.example.com/path?limit=10');
const before = await fetch(`https://api.corsproxy.dev/proxy?url=${target}&key=YOUR_API_KEY`);

// After: same encoded target on proxy.cors.dev, no key for GET and HEAD
const after = await fetch(`https://proxy.cors.dev/?url=${target}`);
const data = await after.json();

// POST needs managed access; X-Cors-Key is never sent upstream
const created = await fetch('https://proxy.cors.dev/https://api.example.com/items', {
  method: 'POST',
  headers: { 'X-Cors-Key': 'YOUR_CONNECTION_KEY', 'Content-Type': 'application/json' },
  body: JSON.stringify({ name: 'example' }),
});

Choose for the requests you actually send.

corsproxy.dev Pro allows 20,000 requests and 10 GB per day, about 600,000 requests in a 30-day month against 500,000 per billing period on cors.dev Pro. It accepts 10 MB bodies and responses against 1 MiB and 6 MiB, and caches for up to 86,400 seconds against 300. Its quota is daily, so a busy day stops at 20,000 requests until 00:00 UTC, and it accepts GET and POST only, while cors.dev Pro adds PUT, PATCH and DELETE. corsproxy.dev keys start with sk_live_ and its terms ask you not to expose them in client-side code, though its docs put them in browser URLs with an optional lock to one origin. Without an account, cors.dev serves public GET and HEAD requests at 600 requests per minute per IP with no daily quota; corsproxy.dev answered a request without a key with HTTP 401 MISSING_API_KEY.

When to stay with corsproxy.dev

Stay with corsproxy.dev if you need POST on a free plan, bodies or responses between 6 MiB and 10 MB, or edge caching longer than 300 seconds. Stay if a provider secret must stay out of the browser: its managed upstream headers store the secret and add it when the target host and path match, and cors.dev never stores or injects upstream secrets. To run a proxy yourself, its separate MIT-licensed Go relay starts with go run main.go with no accounts, and keys and quotas are off by default; its README lists the settings to lock down before exposing it publicly.

Try cors.dev with your own public HTTPS API if its request model fits your app. The managed trial includes 1,000 requests total over 7 days, without a card. For public GET and HEAD APIs, anonymous use needs no account.

Neither a request count nor a price establishes which service is faster or more reliable. Check your payloads, credentials and traffic pattern against the provider's current documentation.

Read the cors.dev request contract Test your API's CORS response