Spec

Code snippets

curl "https://api.oanor.com/cors-api/v1/meta" \
  -H "x-oanor-key: oanor_test_..."

await fetch("https://api.oanor.com/cors-api/v1/meta", {
  headers: { "x-oanor-key": "oanor_test_..." }
});

$ch = curl_init("https://api.oanor.com/cors-api/v1/meta");
curl_setopt($ch, CURLOPT_HTTPHEADER, ["x-oanor-key: oanor_test_..."]);
curl_setopt($ch, CURLOPT_RETURNTRANSFER, true);
$out = curl_exec($ch);

import requests
requests.get(
    "https://api.oanor.com/cors-api/v1/meta",
    headers={"x-oanor-key": "oanor_test_..."}
)

Example response

A real response from this endpoint, captured by the latest health check.

{
    "data": {
        "name": "CORS API",
        "notes": "A wildcard origin '*' cannot be combined with credentials — reflect a specific origin and add Vary: Origin instead. This builds and checks the headers; it does not make a request. Nothing is stored.",
        "version": "v1",
        "endpoints": [
            {
                "path": "/v1/headers",
                "params": {
                    "expose": "response headers to expose",
                    "origin": "a request Origin to reflect/validate",
                    "headers": "allowed request headers (or *) — default Content-Type, Authorization",
                    "max_age": "preflight cache seconds",
                    "methods": "allowed methods — default GET, POST, PUT, PATCH, DELETE, OPTIONS",
                    "origins": "allowed origins (comma list or *) — default *",
                    "credentials": "true to allow credentials"
                },
                "returns": "the Access-Control-* headers to send"
            },
            {
                "path": "/v1/check",
                "params": {
                    "method": "the (requested) method",
                    "origin": "the request Origin (required)",
                    "…policy": "same origins/methods/headers/credentials fields as /v1/headers",
                    "request_headers": "the Access-Control-Request-Headers list"
                },
                "returns": "whether the request is allowed, why not, and the headers to send"
            },
            {
                "path": "/v1/meta",
                "params": [],
                "returns": "this document"
            }
        ],
        "description": "Build correct CORS response headers and evaluate preflight requests. The headers endpoint turns a simple policy — allowed origins, methods, request headers, credentials, max-age and exposed headers — into the exact Access-Control-* headers to return, handling the tricky parts: wildcard vs credentials (you cannot use '*' with credentials), origin reflection and the Vary: Origin header. The check endpoint takes an incoming request's origin, method and requested headers and tells you whether it would pass CORS, why not if it fails, and the headers you should send back. Pure local, no key."
    },
    "meta": {
        "timestamp": "2026-06-03T09:25:00.756Z",
        "request_id": "59d94c28-3c0f-4231-b2a3-fd72fbcf0cb1"
    },
    "status": "ok",
    "message": "Meta",
    "success": true
}