Use cors.dev.

One script. Keep your requests.

Auto repairs supported cross-origin reads in your existing Fetch and async XHR calls. Load it before your application; keep using the API’s original URLs. No key needed for public GET/HEAD.

<script src="https://cors.dev/auto.js"></script>
<script src="/app.js"></script>

Working calls stay native. An eligible failed read gets one proxy fallback inside the same call. Don’t add async: Auto needs to load first.

import { installAuto } from 'https://cors.dev/auto.mjs';

const auto = installAuto();
await import('./app.js');

<script
  src="https://cors.dev/auto.js"
  data-key="YOUR_CONNECTION_KEY"
  data-hosts="api.example.com"
></script>
<script src="/app.js"></script>

Add the prefix. Fetch your data.

Put https://proxy.cors.dev/ before the full URL of any public HTTPS API.

const upstream =
  'https://jsonplaceholder.typicode.com/todos/1';

const response = await fetch(
  `https://proxy.cors.dev/${upstream}`,
  { credentials: 'omit' },
);
if (!response.ok) {
  throw new Error(`Request failed: ${response.status}`);
}
const data = await response.json();

Run this in your frontend, served over HTTP or HTTPS. Keep public query strings as they are; the path form needs no encoding. Handling errors?

Free requests.

Public JSON, XML, HTML, CSV and other text APIs. Your paths and queries, not just our examples.

Methods

GET & HEAD

Max response

1 MiB

Total deadline

10 seconds

Destinations

Public HTTPS endpoints on port 443. Redirects are followed automatically. No request bodies. OPTIONS is handled locally.

Headers

Accept, If-None-Match and If-Modified-Since are forwarded. Your Connection key is not.

Credentials

Public data only: no upstream tokens, passwords, authorization headers or cookies. Use credentials: 'omit'. Common credential query parameters are rejected. Request privacy.

Responses

Responses are checked completely before delivery. Auto Fetch can stream with completion verification. No shared cache or automatic upstream retries. Responses use Cache-Control: no-store, no-transform.

Coming from corsproxy.io or allOrigins? Swap the host and keep your ?url= calls; see the accepted URL forms and the corsproxy.io and allOrigins migration notes.

TRIAL & PRO

Connect your own API.

Check managed availability in your account. Free access is available now.

A Connection key unlocks write methods, custom headers, explicit Authorization and larger responses on your enabled hosts. The trial includes 1,000 requests total over 7 days. Pro includes 500,000 requests per monthly billing period for $5.

Destinations

Public HTTPS hostnames on port 443, enabled on your Connection. No IP literals, private networks or embedded URL credentials.

Methods & size

GET, HEAD, POST, PUT, PATCH and DELETE. Up to 1 MiB per request body and 6 MiB per response, with a 10-second total deadline. Auto Fetch verifies uncached streams; XHR, ordinary proxy requests and cache-selected responses are buffered. No long-lived SSE or automatic upstream retries.

Headers

Explicit Authorization, Content-Type and custom API headers are supported. Browser cookies and your Connection key are never forwarded. Hop-by-hop, browser identity and proxy-control headers are reserved. Use credentials: 'omit'.

Secrets

A browser-visible upstream token is not a secret. Keep private credentials in your own backend. Origin matching limits browser use of your Connection key, but scripted clients can forge an Origin header.

Caching

Opt in on eligible GET requests with X-Cors-Cache: 60, where the value is a whole number of seconds from 1 to 300. Credential-bearing requests and private responses are not cached. Caching is best-effort, not a freshness or hit guarantee; cache hits still count toward your allowance.

Extra requests

When paid checkout is available, Pro accounts can prepay $5 for 500,000 extra requests, plus tax where applicable. Extras are used after the base allowance; unused extras carry over across renewals but require an active Pro subscription. No automatic purchases.

Rate & concurrency

Pro: 600 requests per minute and 10 concurrent requests per account. Trial: 120 per minute and 5 concurrent requests. Shared service capacity and upstream limits also apply.

Usage

Admitted requests count even if the upstream fails. The trial allowance is total, not daily. Pro resets on its billing period, not the calendar month. Rotating a key does not reset usage.

OPTIONAL

Give your project a Connection.

Save exact browser origins and API hosts in your dashboard, then add the Connection’s publishable key to your request.

const upstream =
  'https://jsonplaceholder.typicode.com/todos/1';

const response = await fetch(
  `https://proxy.cors.dev/${upstream}`,
  {
    headers: { 'X-Cors-Key': 'YOUR_CONNECTION_KEY' },
    credentials: 'omit',
  },
);

Find out what happened.

Supported upstream statuses and bodies are preserved. Check X-Cors-Source to see where a response came from.

upstream

The API answered, including its own 404 or 429 responses.

gateway

cors.dev rejected or couldn’t complete the request.

const upstream =
  'https://jsonplaceholder.typicode.com/todos/1';

const response = await fetch(
  `https://proxy.cors.dev/${upstream}`,
  {
    credentials: 'omit',
  },
);

if (!response.ok) {
  const code = response.headers.get('X-Cors-Error');
  const id = response.headers.get('X-Cors-Request-Id');

  throw new Error(
    `HTTP ${response.status}: ${code ?? 'upstream error'} (${id})`,
  );
}

const data = await response.json();

A browser CORS error with no readable response can also come from connectivity or edge protection. A successful curl request alone does not verify your browser integration.