CORS origins

CORS controls which browser origins may read allowed responses. It is not authentication and does not grant a role or space membership.

Configure an origin

Open project API → CORS origins. Add the application’s origin, such as http://localhost:3000 for development or https://studio.example.com for production. An origin includes scheme, hostname, and any non-default port; use an origin rather than a Studio page path.

Review the Credentials setting, shown as Allowed or Not Allowed. Credentialed browser requests require appropriate server response headers and client configuration. Do not assume an arbitrary saved wildcard or URL with a path is a recommended origin pattern.

Diagnose a browser failure

1. Inspect the request’s actual Origin in browser developer tools.
2. Compare it with the configured origin, including HTTP versus HTTPS and the port.
3. Inspect the preflight response and requested headers.
4. Check authentication separately; an allowed origin does not make an invalid token valid.
5. After changes, account for cached preflight responses when retesting.

For the standard Studio setup, retain the framework handler. Avoid replacing the supported same-origin flow with an ad hoc cross-origin cookie implementation.