CORS Header Builder
Generate the correct Access-Control-* response headers for your API. Choose the allowed origin, methods, headers and credentials, and copy the result into your server config.
About this tool
Generate the correct Access-Control-* response headers for your API. Choose the allowed origin, methods, headers and credentials, and copy the result into your server config.
Example
Input: origin *, GET POST
Output: Access-Control-Allow-Origin: *...
Privacy
This tool runs entirely in your browser. Your data is processed locally and never uploaded to a server.
How to use this tool
- Enter the origin your frontend is allowed to call from, such as a single domain or a wildcard if your setup allows it.
- Choose the HTTP methods your API should accept, like GET, POST, or OPTIONS.
- Add the request headers your browser clients are allowed to send, and decide whether credentials should be included.
- Copy the generated Access-Control-* headers into your server or proxy config.
Step by step, what happens
- You provide the CORS settings your API should expose, including allowed origin, methods, headers, and credentials.
- The tool formats those choices into the correct Access-Control response headers.
- It keeps the output focused on browser CORS behavior, so you can paste it into server config without rewriting header names.
- You review the result to make sure it matches your frontend and security rules before deploying it.
Worked example
A backend for a React app on app.example.com needs to allow a POST request with JSON and authentication cookies.
Input: origin: https://app.example.com
methods: GET, POST
headers: Content-Type, Authorization
credentials: true
- The tool reads the allowed origin, methods, headers, and the credentials setting from the input.
- It converts that setup into CORS response headers that browsers understand.
- Because credentials are enabled, it keeps the origin explicit instead of using a wildcard.
Output: Access-Control-Allow-Origin: https://app.example.com
Access-Control-Allow-Methods: GET, POST
Access-Control-Allow-Headers: Content-Type, Authorization
Access-Control-Allow-Credentials: true
Tips and common mistakes
- Do not use a wildcard origin when credentials are enabled, because browsers reject that combination.
- Make sure the allowed methods include OPTIONS if your API needs to pass preflight requests.
- Only list headers your frontend really sends, otherwise you may allow more than you intended.
- If your API serves multiple trusted origins, generate a separate policy for each one instead of assuming one header fits every case.
Frequently asked questions
What is CORS?
Cross-Origin Resource Sharing controls which web origins may read responses from your API, enforced by browsers.
Why can I not use * with credentials?
The spec forbids wildcard origin when credentials (cookies) are allowed; you must name a specific origin.
Where do these headers go?
Add them to your API's responses in your server or framework configuration.
More Developer Tools Tools
Explore related calculators in this category
Password Strength Checker
Check how strong a password is based on length, character variety and common patterns. 100% private.
VIN Validator
Validate a Vehicle Identification Number (VIN) using the North American check-digit formula.
.htaccess Generator
Generate common .htaccess rules, force HTTPS, www redirect, and caching, with checkboxes.
API Key Generator
Generate random, secure API keys and tokens with an optional prefix. Cryptographically secure.
You Might Also Like
Popular tools from other categories
CDN & Cache Header Guide
Understand which CDN serves a site from its response headers.
Color Contrast Checker (WCAG)
Check the WCAG contrast ratio between a text and background color.
Divisibility Rules Checker
Check divisibility by common numbers.
Favicon URL Builder
Build the standard favicon HTML tags for your site.
Can't Find the Right Calculator?
Try our AI Math Solver, type any problem in plain English and get instant step-by-step solutions.