ShareYourGroupShareYourGroupFree Public APIs

CORS: why a web page cannot call some APIs

An API can work in curl and still fail in your web page. The reason is a browser rule.

The rule

A browser lets a page read the answer of a request to another site only if that site says it is allowed. The permission is a response header: Access-Control-Allow-Origin: * (anyone) or the address of your site. Without it the request may still reach the server, but the page cannot read the answer, and fetch fails.

A real blocked call

On 14 November 2026 we asked Chrome, from a page on one local address, to read https://example.com/ with fetch. The result was a failure: "TypeError: Failed to fetch". The same address works in curl and in the address bar: the rule only applies to scripts in pages. All the APIs in this directory were called the same way and they answered, because they send an allow header.

How to test an API

  1. Request it with curl and look at the headers: curl -i -H "Origin: https://yoursite.example" "API address". Look for access-control-allow-origin.
  2. Or call it with fetch from a page and watch the browser console.

When CORS blocks you

  1. Pick another API that allows browser access.
  2. Call it from a server (your own backend or a serverless function), where the rule does not apply, and let your page call that.
  3. Do not try to switch off the browser's protection for your visitors: it cannot be done from a page, and extensions that do it are not for production.

Keys and servers

If an API needs a secret key, the call must come from a server, so that the key stays secret. That is the usual reason to have a backend.

Does CORS protect the API?

No. It protects users, by stopping a page from reading data of another site that they are logged in to.

Why does a preflight request appear?

For requests with custom headers or methods other than simple GET and POST, the browser first asks the server with an OPTIONS request whether it is allowed.

Sources

  • Our own test, repeated in verify.py of this section

Read on 14 November 2026.

This is an independent directory. It is not connected with any of the services listed. Each address was called on 14 November 2026 with curl, Python, Node.js and Chrome (from a page on another site), and the answer shown is a real one. APIs change: check the service's own page before you depend on it.