---
title: 'flexkit cors'
description: 'List, add and remove the browser origins allowed to call the project API, from the terminal or a CI pipeline.'
---

# `flexkit cors`

Manages the project's [CORS allowlist](/docs/api/cors): the browser origins, such as a hosted Studio or your web app, that may call the project API. CORS is not authentication; an allowed origin still needs a valid session or token.

## Synopsis

```bash
flexkit cors <subcommand> [arguments] [options]
```

Running `flexkit cors` without a subcommand runs `flexkit cors ls`.

## Origin format

An origin is `<scheme>://<host>[:<port>]`, for example `https://studio.example.com` or `http://localhost:3000`. Matching is exact, including the scheme and port. A `*` can stand for one hostname label (`https://*.example.com` matches `https://app.example.com`, not `https://example.com` or `https://a.b.example.com`), for the port (`http://localhost:*`) or for the scheme. A trailing `/` is removed. Quote values with `*` in the shell.

## `cors ls`

List the allowed origins with their id and credentials setting. Alias: `list`.

```bash
flexkit cors ls [--json]
```

### Examples

```bash
# List origins
flexkit cors ls

# Origins only, one per line
flexkit cors ls --json | jq -r '.origins[].origin'
```

## `cors add`

Allow one or more origins. Origins already in the list are skipped, so the command is safe to rerun. Alias: `allow`.

```bash
flexkit cors add <origin>... [--credentials] [--json]
```

`--credentials` marks the added origins as sending credentials (cookies). If any listed origin has it, the API answers with `Access-Control-Allow-Credentials: true` for every allowed origin. Origins already in the list keep their setting; remove and add them again to change it.

### Examples

```bash
# Allow local development
flexkit cors add http://localhost:3000

# Allow production and every preview subdomain
flexkit cors add https://studio.example.com 'https://*.preview.example.com'
```

## `cors rm`

Remove origins, by origin or by the id shown in `flexkit cors ls`. Every value is looked up first, so a typo removes nothing. The command asks for confirmation; pass `--yes` in scripts. Alias: `remove`.

```bash
flexkit cors rm <origin|id>... [--yes] [--json]
```

The change applies to the next request, but browsers may reuse a cached preflight response for up to two hours.

### Examples

```bash
# Remove an origin
flexkit cors rm http://localhost:3000

# Remove by id without a prompt
flexkit cors rm 42 43 --yes
```

## Options

| Option                 | Subcommands | Description                                                    |
| ---------------------- | ----------- | -------------------------------------------------------------- |
| `--credentials`        | `add`       | Mark the added origins as sending credentials.                 |
| `--yes`, `-y`          | `rm`        | Skip the confirmation prompt.                                  |
| `--json`               | all         | Print JSON on stdout.                                          |
| `--project <ID>`, `-p` | all         | Project to use. Default: the [linked](/docs/cli/link) project. |

See also the [global options](/docs/cli/global-options).

## Permissions

- Listing origins needs the **Owner**, **Developer** or **Viewer** role.
- Adding and removing origins needs the **Owner** or **Developer** role.
- Commands work with a `flexkit login` session and with project API tokens, with the token's own role. Changes made with a token are attributed to the member who created it.
- `add --credentials` needs a `flexkit login` session: with a token it answers `Allowing credentials needs a signed-in user.` Tokens can add origins without credentials and remove origins.

## Configure CORS in CI

Allow each preview deployment's URL before its end-to-end tests run, with a **Developer** project API token stored as a CI secret:

```yaml filename=".github/workflows/preview.yml"
jobs:
  e2e:
    runs-on: ubuntu-latest
    env:
      FLEXKIT_TOKEN: ${{ secrets.FLEXKIT_TOKEN }}
      FLEXKIT_PROJECT_ID: my-project-id
    steps:
      - run: npm install -g @flexkit/cli
      - name: Allow the preview origin
        run: flexkit cors add "${{ github.event.deployment_status.environment_url }}"
      # … run the tests against the preview …
```

Rerunning the job is safe: `add` skips origins already in the list. Remove previews you no longer need with `flexkit cors rm <origin> --yes`, or use one wildcard such as `'https://*.preview.example.com'` instead of an origin per preview.


---

[View full sitemap](/docs/sitemap.md)