> For the complete documentation index, see [llms.txt](https://codemash.gitbook.io/codemash/llms.txt). Markdown versions of documentation pages are available by appending `.md` to page URLs; this page is available as [Markdown](https://codemash.gitbook.io/codemash/api-reference/guides/cors.md).

# CORS

Calling Norbix from a web page — which origins and headers the browser may use.

A browser blocks a web page from calling another host unless that host allows it. This is called CORS (Cross-Origin Resource Sharing). Before the real call, the browser sends a "preflight" `OPTIONS` request; Norbix answers it with the origins, methods and headers it accepts.

## How Norbix models it

There are two lists:

| List                                    | Where it is set                                                                                                                                                     | What it does today                                                                                                                                                                  |
| --------------------------------------- | ------------------------------------------------------------------------------------------------------------------------------------------------------------------- | ----------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- |
| **The installation list**               | Fixed by the installation                                                                                                                                           | Cloud, the Admin portal and the installation's own domains (`cloud.<domain>`, `admin.<domain>`, `<domain>`). A development installation also accepts any `http://localhost:<port>`. |
| **Allowed Origins (CORS)** of a project | Cloud → Project → Settings → **Access** → **CORS**, or [Update project allowed origins](/codemash/api-reference/account/projects/update-project-allowed-origins.md) | Saved with the project.                                                                                                                                                             |

{% hint style="warning" %}
Today the browser check uses only the installation list. Origins you add under **Allowed Origins (CORS)** are saved, but a page on that origin is still refused: on a test installation, `https://shop.example.com` was added to a project, and the preflight from that origin answered `204` with no `Access-Control-Allow-Origin` header, so the browser blocks the call. Until this is fixed, call Norbix from your own server (or from the Admin portal), not straight from a web page on your own domain.
{% endhint %}

The setting in Cloud: Project → **Settings** → **Access** → **CORS** → **Allowed Origins (CORS)**. Origins are separated by commas, for example `http://localhost:3000,https://myproject.com`. An origin without a scheme is saved as `https://…`.

### Headers a browser may send

`Authorization`, `Content-Type`, `norbix-env`, `nb-region`, `norbix-region`, `norbix-zone-id`, `norbix-project-id`, `norbix-account-id` and a few standard ones. `X-Api-Key` and `nb-project-id` are **not** on the list — from a browser, send the key as `Authorization: Bearer …` and the project as the `projectId` parameter ([Authentication](/codemash/api-reference/guides/authentication.md)).

{% hint style="danger" %}
Never put an admin key in a web page: anyone can read it. A page should sign its users in (Membership) and use their token, or call your own server, which holds the key.
{% endhint %}

## Where you use it

* Cloud: [Project settings → Access](/codemash/cloud/project/settings/access.md)
* [Authentication](/codemash/api-reference/guides/authentication.md) · [Base URLs](/codemash/api-reference/guides/base-urls.md)