`flexkit cors`

Manages the project’s CORS allowlist: the browser origins, such as a hosted Studio or your web app, that may call the project API. CORS is not authentication; an allowed origin still needs a valid session or token.

Synopsis

flexkit cors <subcommand> [arguments] [options]

Running flexkit cors without a subcommand runs flexkit cors ls.

Origin format

An origin is <scheme>://<host>[:<port>], for example https://studio.example.com or http://localhost:3000. Matching is exact, including the scheme and port. A * can stand for one hostname label (https://*.example.com matches https://app.example.com, not https://example.com or https://a.b.example.com), for the port (http://localhost:*) or for the scheme. A trailing / is removed. Quote values with * in the shell.

`cors ls`

List the allowed origins with their id and credentials setting. Alias: list.

flexkit cors ls [--json]

Examples

# List origins
flexkit cors ls
 
# Origins only, one per line
flexkit cors ls --json | jq -r '.origins[].origin'

`cors add`

Allow one or more origins. Origins already in the list are skipped, so the command is safe to rerun. Alias: allow.

flexkit cors add <origin>... [--credentials] [--json]

--credentials marks the added origins as sending credentials (cookies). If any listed origin has it, the API answers with Access-Control-Allow-Credentials: true for every allowed origin. Origins already in the list keep their setting; remove and add them again to change it.

Examples

# Allow local development
flexkit cors add http://localhost:3000
 
# Allow production and every preview subdomain
flexkit cors add https://studio.example.com 'https://*.preview.example.com'

`cors rm`

Remove origins, by origin or by the id shown in flexkit cors ls. Every value is looked up first, so a typo removes nothing. The command asks for confirmation; pass --yes in scripts. Alias: remove.

flexkit cors rm <origin|id>... [--yes] [--json]

The change applies to the next request, but browsers may reuse a cached preflight response for up to two hours.

Examples

# Remove an origin
flexkit cors rm http://localhost:3000
 
# Remove by id without a prompt
flexkit cors rm 42 43 --yes

Options

Option	Subcommands	Description
`--credentials`	`add`	Mark the added origins as sending credentials.
`--yes`, `-y`	`rm`	Skip the confirmation prompt.
`--json`	all	Print JSON on stdout.
`--project <ID>`, `-p`	all	Project to use. Default: the linked project.

Permissions

Listing origins needs the Owner, Developer or Viewer role.
Adding and removing origins needs the Owner or Developer role.
Commands work with a flexkit login session and with project API tokens, with the token’s own role. Changes made with a token are attributed to the member who created it.
add --credentials needs a flexkit login session: with a token it answers Allowing credentials needs a signed-in user. Tokens can add origins without credentials and remove origins.

Configure CORS in CI

Allow each preview deployment’s URL before its end-to-end tests run, with a Developer project API token stored as a CI secret:

.github/workflows/preview.yml

jobs:
  e2e:
    runs-on: ubuntu-latest
    env:
      FLEXKIT_TOKEN: ${{ secrets.FLEXKIT_TOKEN }}
      FLEXKIT_PROJECT_ID: my-project-id
    steps:
      - run: npm install -g @flexkit/cli
      - name: Allow the preview origin
        run: flexkit cors add "${{ github.event.deployment_status.environment_url }}"
      # … run the tests against the preview …

Rerunning the job is safe: add skips origins already in the list. Remove previews you no longer need with flexkit cors rm <origin> --yes, or use one wildcard such as 'https://*.preview.example.com' instead of an origin per preview.