CORS Header Builder

Build correct Access-Control-* response headers for any CORS configuration. Toggle methods, set allowed/exposed headers, enable credentials mode, and get nginx and Express.js code snippets.

Use * for public APIs, or a specific origin when using credentials.
Comma-separated request headers the browser may send.
Response headers JS can read beyond the safe defaults.
Allow CredentialsPermits cookies and auth headers. Requires a non-* origin.

Preflight (OPTIONS) response headers

Access-Control-Allow-Origin: *
Allows any origin. Cannot be used with credentials.
Access-Control-Allow-Methods: GET, POST, OPTIONS
HTTP methods the browser is allowed to use in the actual request.
Access-Control-Allow-Headers: Content-Type, Authorization
Request headers allowed in the actual request.
Access-Control-Max-Age: 86400
Browser may cache the preflight result for 86400 seconds.

Actual request response headers

Access-Control-Allow-Origin: *
Tells the browser which origin is allowed to read the response.
335 chars · 335 B13pxNginx
372 chars · 372 B13pxJavaScript

CORS Header Builder

Build correct Access-Control-* response headers for any CORS configuration. Toggle methods, set allowed/exposed headers, enable credentials mode, and get nginx and Express.js code snippets.

Common uses

  • Build CORS headers for an API with specific origins
  • Get a ready-to-paste Express.js CORS snippet

Also searched as

  • cors headers generator
  • cors configuration builder
  • enable cors nginx config
  • enable cors express snippet
  • access-control-allow-origin example
  • cors preflight response headers
  • cors allow credentials setup
  • access-control-allow-methods builder
  • access-control-max-age
  • no access-control-allow-origin header fix

Frequently asked questions

How do I set up CORS headers for my API?

Use the Builder tab to set the origin, methods, allowed and exposed headers, max age and credentials, and copy the resulting Access-Control-* headers.

Can I get nginx or Express code for CORS?

Yes, the builder produces nginx and Express.js snippets.

Can I use a wildcard origin with credentials?

Browsers reject a wildcard Access-Control-Allow-Origin when credentials are allowed, so specify an explicit origin. The Header Reference tab explains each header.

What does the CORS preflight request do?

It is an OPTIONS request browsers send first to check which methods and headers are allowed.

Is my data uploaded to a server?

No. This tool runs entirely in your browser — your input is processed locally on your device and is never uploaded or stored on a server.