# API Cors

> Configure CORS for browser-facing APIs: simple vs preflight, Allow-* headers, credentials, and origin allowlists. Use when enabling SPA access or debugging OPTIONS preflight failures.

- Skill: `deangrant/api-cors` (Agent Skill, multi-file: 4 files)
- Install (CLI): `npx skillmds@latest add deangrant/api-cors`
- Raw SKILL.md: https://api.skillmd.com/api/skills/deangrant/api-cors/raw
- Safety review: pending
- Works with: Claude Code, Claude.ai, OpenAI Codex
- Category: Integrations & APIs
- Author: deangrant (https://skillmd.com/u/deangrant)
- Updated: 2026-09-17
- Page: https://skillmd.com/skills/deangrant/api-cors

---


# Cross-Origin Resource Sharing (CORS)

Use this skill when browsers call the API from another origin.

---

## 1. Simple vs preflight

Simple requests skip preflight; others trigger `OPTIONS` with
`Access-Control-Request-*`. Respond with `Access-Control-Allow-Origin`,
`Allow-Methods`, `Allow-Headers`, and optional `Max-Age`.

---

## 2. Credentials

With cookies/credentials: **explicit origins** — never `*` with credentials.
Reflect only allowlisted origins.

---

## 3. Quick checklist

- [ ] Explicit origin allowlist (no `*` with credentials).
- [ ] OPTIONS preflight handled.
- [ ] Methods/headers allowlists match real API.
- [ ] Do not use CORS as an authz control (server still enforces auth).

See [reference.md](reference.md) and [examples.md](examples.md).