Access-Control-Allow-Credentials
Whether the browser may expose the response when the request carried cookies or auth.
Response header (sent by servers) cors
How it works
Only meaningful with a specific allowed origin. Browsers reject it combined with Access-Control-Allow-Origin: *.
Example
Access-Control-Allow-Credentials: true
See it live: send any request in Endpoint Client and open the Headers tab, where every response header is explained. Specification: Fetch Standard.
Related headers
Access-Control-Allow-Headers
Request headers a cross-origin page may send.
Access-Control-Allow-Methods
Methods a cross-origin page may use.
Access-Control-Allow-Origin
Which web origin may read this response from browser JavaScript.
Access-Control-Expose-Headers
Response headers that cross-origin JavaScript may read.
Access-Control-Max-Age
How long the browser may cache a preflight result, in seconds.
Origin
The web origin that initiated the request.