> For the complete documentation index, see [llms.txt](https://docs.serverlessapigateway.com/llms.txt). Markdown versions of documentation pages are available by appending `.md` to page URLs; this page is available as [Markdown](https://docs.serverlessapigateway.com/reference/cors-basics/cors-credentials-and-origins.md).

# CORS: Credentials and Origins

Set credentials and origins deliberately so browser auth works without opening the API too broadly. When `allow_credentials` is true, the browser requires an exact origin match -- wildcard origins are not permitted. This page explains the interaction between these two fields and common pitfalls.

**Last reviewed:** 2026-03-06

## When to use this

Use the CORS and response reference when you need to control how the gateway handles browser cross-origin requests or what shape responses take for static, error, and operational endpoints. CORS is configured globally and applies to all routes unless overridden by an explicit OPTIONS handler.

## Key concepts

* The CORS block is global -- it applies the same origin, method, and header policy to all routes. Per-route CORS overrides require explicit OPTIONS path entries.
* The gateway returns a 204 No Content response for OPTIONS preflight requests automatically. You only need an explicit OPTIONS route if a specific path requires different CORS headers.
* Static response routes can return JSON objects, strings, booleans, or null. The gateway serializes the `response` field as-is and sets `Content-Type: application/json`.
* Error responses follow a consistent JSON shape with `error` and `message` fields. 401 errors include details about which JWT check failed (expiry, issuer, audience).
* The gateway adds a `powered-by` response header by default. This can be useful for debugging which gateway version handled a request.

## Repo-grounded example

```json
{
  "cors": {
    "allow_origins": ["https://app.example.com"],
    "allow_methods": ["GET", "POST", "OPTIONS"],
    "allow_headers": ["Content-Type", "Authorization", "X-Refresh-Token"],
    "expose_headers": ["X-Request-Id"],
    "allow_credentials": true,
    "max_age": 300
  }
}
```

This snippet sets `allow_credentials: true` alongside a specific origin in `allow_origins`. If you set credentials to true with a wildcard origin, the browser will reject the response, so the gateway requires an explicit origin list.

## Troubleshooting

* If the browser shows a CORS error, check that `allow_origins` includes the exact origin (scheme + domain + port) your frontend uses -- wildcards are not supported when `allow_credentials` is true.
* If preflight requests return 404 instead of 204, verify that the global CORS block is present in your config and that no explicit OPTIONS route is shadowing the default behavior.
* If a static response returns `null` as a string instead of JSON null, make sure the `response` field is set to `null` (no quotes) in the config JSON.
* If error responses do not include the expected `message` field, confirm you are testing against a current gateway version -- older versions used a different error shape.

## Related docs

* [cors](/configuration/cors.md)
* [introduction](/getting-started/introduction.md)
* [gateway troubleshooting matrix](/troubleshooting/wrangler-deploy-guide/gateway-troubleshooting-matrix.md)


---

# Agent Instructions
This documentation is published with GitBook. GitBook is the documentation platform designed so that both humans and AI agents can read, navigate, and reason over technical content effectively. Learn more at gitbook.com.

## Querying This Documentation
If you need additional information that is not directly available in this page, you can query the documentation dynamically by asking a question.

Perform an HTTP GET request on the current page URL with the `ask` query parameter, and the optional `goal` query parameter:

```
GET https://docs.serverlessapigateway.com/reference/cors-basics/cors-credentials-and-origins.md?ask=<question>&goal=<endgoal>
```

`ask` is the immediate question: it should be specific, self-contained, and written in natural language.
`goal` is optional and describes the broader end goal you are ultimately trying to accomplish on behalf of the user. GitBook uses it to tailor the answer towards what is most useful for that goal.

The response will contain a direct answer to the question and relevant excerpts and sources from the documentation.

Use this mechanism when the answer is not explicitly present in the current page, you need clarification or additional context, or you want to retrieve related documentation sections.