Access-Control-Allow-Origin
Which web origin may read this response from browser JavaScript.
Response header (sent by servers) cors
How it works
Without it, browsers block cross-origin pages from reading the response, even though the server still processed the request. * allows any origin but not credentialed requests.
Example
Access-Control-Allow-Origin: https://app.example.com
See it live: send any request in Endpoint Client and open the Headers tab, where every response header is explained. Specification: Fetch Standard.
Related headers
Access-Control-Allow-Credentials
Whether the browser may expose the response when the request carried cookies or auth.
Access-Control-Allow-Headers
Request headers a cross-origin page may send.
Access-Control-Allow-Methods
Methods a cross-origin page may use.
Access-Control-Expose-Headers
Response headers that cross-origin JavaScript may read.
Access-Control-Max-Age
How long the browser may cache a preflight result, in seconds.
Origin
The web origin that initiated the request.