# corsproxy.dev > Managed browser-to-API access for frontend teams shipping production integrations. A managed CORS relay with API keys, rate limits, logs, and a dashboard. A simpler open-source relay is available under MIT for self-hosting. corsproxy.dev solves the problem of calling third-party APIs from a browser without setting up your own backend. It runs on Cloudflare Workers. Features: - Origin-locked API keys: one allowed browser origin per key (Free keys also always allow localhost); browser-only protection, combine with allowed target hosts - Exact per-account daily limits via Durable Objects, with X-RateLimit-* headers and an email when the limit is hit - Managed upstream headers: store a third-party API secret on your key so it is added server-side and never ships in browser code - Edge caching with `ttl=` on GET requests (Pro), private to each API key; responses carry X-Cache: HIT or MISS - Per-request header overrides with repeatable `reqHeaders=name:value` and `resHeaders=name:value` (same syntax as corsproxy.io) - Private-network (SSRF) blocking; upstream Set-Cookie stripped - GET and POST (plus CORS preflight); binary-safe requests and responses up to 10 MB each - Dashboard with the last 100 calls, 30 days of request history, and per-key usage - Remote MCP server at https://api.corsproxy.dev/mcp (Streamable HTTP, X-API-Key + allowed Origin): tools fetch_url, check_quota, explain_error - Plans: Free 500 requests/day and 250 MB/day; Pro $5/month for 20,000 requests/day and 10 GB/day; Enterprise on request (the only plan with an SLA) A separate, simpler CORS relay is published as MIT-licensed Go on GitHub (https://github.com/melihbirim/corsproxy) for teams that want to self-host. It has no API keys, quotas, managed headers or caching, and forwards request headers as they are. ## Documentation - [About](https://corsproxy.dev/about/): Who runs corsproxy.dev, how the content is written and fact-checked, and how to report a mistake or a security issue. - [API documentation](https://corsproxy.dev/docs/): Quickstart, authentication, the core `/proxy?url=…&key=…` request format, switching from another CORS proxy, managed upstream headers, header overrides, caching, every error reason key with its status, and the full endpoint list. - [OpenAPI 3.1 specification](https://corsproxy.dev/openapi.yaml): Machine-readable contract for the public API (proxy, MCP, health). API keys only work on these endpoints. - [Postman collection](https://corsproxy.dev/corsproxy.postman_collection.json): Import into Postman, set `api_key` and `origin`, and call the proxy and MCP endpoints. - [Live JSON docs](https://api.corsproxy.dev/v1/docs): Always reflects what the deployed worker actually serves. - [How corsproxy.dev compares](https://corsproxy.dev/compare/): Side-by-side comparison against public CORS proxies (cors-anywhere, allorigins), a DIY Cloudflare Worker, and your own backend. Tradeoffs for each option. - [Glossary](https://corsproxy.dev/glossary/): Plain-English definitions for CORS, preflight, Access-Control-Allow-Origin, credentialed-request, SSRF, same-origin-policy, origin, and CORS proxy. ## Blog (high-signal tutorials) - [Server-Sent Events and CORS: EventSource's limits](https://corsproxy.dev/blog/server-sent-events-and-cors): EventSource has no headers option and its only CORS setting is withCredentials. What that controls, how to authenticate it against corsproxy.dev, and why a buffering proxy still can't make it stream live. - [CORS in Go: net/http, Gin, and Chi](https://corsproxy.dev/blog/cors-in-go): net/http sends no CORS headers by default. Tested against a hand-rolled middleware, gin-contrib/cors 1.7.9, and go-chi/cors 1.2.2. - [Caching API responses with the ttl parameter](https://corsproxy.dev/blog/cors-proxy-caching-ttl): On Pro and Enterprise, ttl caches a successful GET response at the Cloudflare data center that served it. The cache key, what X-Cache means, and why a hit still counts against your daily quota. - [Why CORS proxies don't follow redirects for you](https://corsproxy.dev/blog/cors-proxy-redirects): corsproxy.dev passes a target's 3xx straight through instead of following it. Why that's a safety choice, how the open-source relay differs, and how to work around it. - [The Sec-Fetch-Site header, and what breaks it](https://corsproxy.dev/blog/sec-fetch-site-header): What Sec-Fetch-Site carries, why servers use it as a CSRF defense, and why forwarding it through a proxy stops meaning what the receiving server assumes. - [Cloudflare's CORS proxy Worker, benchmarked against corsproxy](https://corsproxy.dev/blog/cloudflare-cors-proxy-worker-benchmark): Cloudflare's CORS header proxy example and the open-source corsproxy in one Docker network: two load levels, seven security probes, every command reproducible. - [How to allow CORS on any server](https://corsproxy.dev/blog/how-to-allow-cors): Copy-paste CORS configs for Nginx, Apache, Go, Spring Boot, Cloudflare Workers, Netlify and Vercel, plus a curl check and the three mistakes that keep the error alive. - [cloudflare-cors-anywhere, read from the source](https://corsproxy.dev/blog/cloudflare-cors-anywhere-source-read): A line-by-line read of the most-forked self-hosted Cloudflare Workers CORS proxy: wide-open origin check, Authorization/Cookie forwarded with no target restriction, and an unenforced rate limit. - [Fixing the Access-Control-Allow-Headers error](https://corsproxy.dev/blog/access-control-allow-headers-error): A custom header gets rejected during preflight before the real request goes out. The Authorization exception to the wildcard, and how to fix it on either end. - [Why CORS doesn't apply to WebSockets](https://corsproxy.dev/blog/cors-and-websockets): A WebSocket handshake never sends a CORS preflight, so Access-Control-Allow-Origin does nothing for it. What actually gates a WebSocket connection, and how to restrict origins yourself. - [Null origin in CORS: why you can't trust it](https://corsproxy.dev/blog/cors-null-origin): Origin: null comes from sandboxed iframes and file:// pages, and any attacker can trigger it on demand. Why allowlisting it in CORS is a known vulnerability, not a workaround. - [api.codetabs.com proxy is down: what to do](https://corsproxy.dev/blog/codetabs-cors-proxy-down): The codetabs CORS proxy was disabled in June 2026 after an abuse suspension. How to confirm the outage and the replacement options in order of durability. - [CORS in Django: setting up django-cors-headers](https://corsproxy.dev/blog/cors-in-django): Django sends no CORS headers on its own. Install, middleware order, origin settings, and credentials, tested against Django 5.2 and django-cors-headers 4.9.0. - [CORS in Next.js: Route Handlers, proxy.ts, and next.config.js](https://corsproxy.dev/blog/cors-in-nextjs): Next.js doesn't send CORS headers for you. Tested against Next.js 16.3, including the middleware.ts to proxy.ts rename. - [Cloudflare KV vs D1 vs Durable Objects, in production](https://corsproxy.dev/blog/cloudflare-kv-vs-d1-vs-durable-objects): Why corsproxy.dev uses all three Cloudflare storage primitives at once, the rule of thumb for picking between them, and why the Workers Rate Limiting binding isn't a substitute for an exact quota. - [CORS proxy cookie forwarding: what we fixed](https://corsproxy.dev/blog/cors-proxy-cookie-forwarding): A proxy that relays a Cookie header to whatever target it's given can leak a session cookie to the wrong domain. The fix, and how to check your own proxy. - [When not to use a CORS proxy](https://corsproxy.dev/blog/when-not-to-use-a-cors-proxy): A CORS proxy fixes one specific problem. Six situations where it's the wrong tool, and what to do instead. - [CORS preflight caching: how Access-Control-Max-Age works](https://corsproxy.dev/blog/cors-preflight-cache): The cache key, the per-browser caps (Chrome 7200s, Firefox 86400s), and what still forces a re-check. - [An MCP server for safe API calls from AI agents](https://corsproxy.dev/blog/mcp-server-for-ai-agents): Remote MCP server for Claude Code, Cursor, and agents; secrets injected server-side, SSRF blocked, hard quotas, and what it does not do yet. - [CSP vs CORS: why your fetch is blocked](https://corsproxy.dev/blog/csp-vs-cors): Content-Security-Policy and CORS are separate checks with separate fixes. How to tell them apart from the console message. - [Why am I getting a CORS error?](https://corsproxy.dev/blog/why-am-i-getting-a-cors-error): The CORS checks the browser runs, how to tell a CORS error from mixed content, and three concrete fixes. - [How to enable CORS in Node.js and Express](https://corsproxy.dev/blog/enable-cors-nodejs-express): One-line dev fix, production allowlist, per-route config, common gotchas. - [CORS with cookies and credentials](https://corsproxy.dev/blog/cors-with-cookies-credentials): The four moving parts that have to align when sessions cross origins. Includes code. - [5 ways to fix CORS in development](https://corsproxy.dev/blog/cors-in-development): Server-side CORS, Next.js rewrites, a CORS proxy, the Vite dev proxy, a flag-disabled browser, ordered by production safety. - [Free CORS proxy comparison (2026)](https://corsproxy.dev/blog/free-cors-proxy-comparison): cors-anywhere, allorigins, ThingProxy, corsproxy.io, cors.sh, cors.lol, corsproxy.dev — what's still maintained, what to check before choosing, and what to do when your proxy starts returning 429s. - [How a CORS proxy can be abused](https://corsproxy.dev/blog/cors-proxy-security): SSRF, credential laundering, bandwidth burn. The threat model and the mitigations corsproxy.dev applies. - [Self-host vs managed CORS proxy](https://corsproxy.dev/blog/self-host-vs-managed): The managed service and the simpler open-source relay differ in behaviour, not just hosting. Cost, control, security, and when each fits. - [Migrating from cors-anywhere](https://corsproxy.dev/blog/migrating-from-cors-anywhere): Migration path, what changes in the request, and code for fetch, Axios, and helper wrappers. - [CORS proxy for Webflow, Framer, and Bubble custom code](https://corsproxy.dev/blog/cors-proxy-for-nocode-webflow-framer-bubble): Copy-paste fixes for CORS errors in no-code custom code embeds. - [Do you need a CORS proxy in React Native or Expo?](https://corsproxy.dev/blog/do-you-need-a-cors-proxy-in-react-native): Which parts of an RN/Expo app run in a real browser and are actually subject to CORS. - [Call OpenAI, Notion, and Google Sheets from the browser without leaking your API key](https://corsproxy.dev/blog/call-public-apis-from-the-browser-without-a-backend): Keep third-party secrets out of client-side JavaScript with managed upstream headers, and the limits of that approach. - [Blocking a country's traffic with Cloudflare WAF](https://corsproxy.dev/blog/blocking-a-country-with-cloudflare-waf): A WAF geo-block rule for a traffic flood, common expression mistakes, and how to verify the rule. - [Rate limits and quotas, explained](https://corsproxy.dev/blog/rate-limits-and-quotas-explained): What counts against your daily request and bandwidth quotas, why you got a 429, and how the counter is enforced atomically. - [corsproxy.dev vs corsproxy.io](https://corsproxy.dev/blog/corsproxy-dev-vs-corsproxy-io): Side-by-side comparison of free tiers, pricing, SLAs, secret handling, and open source, including where corsproxy.io is ahead. - [corsproxy.dev vs cors.sh](https://corsproxy.dev/blog/corsproxy-dev-vs-cors-sh): Two Cloudflare-edge proxies compared, using cors.sh's own committed spec, including where cors.sh is ahead. ## Optional - [Service status](https://corsproxy.dev/status/): Live health probes of the API worker, marketing site, dashboard, and Cloudflare edge from the visitor's browser. - [Legal: Terms of Service](https://corsproxy.dev/legal/terms/) - [Legal: Privacy Policy](https://corsproxy.dev/legal/privacy/): GDPR posture, Cloudflare sub-processor disclosure, data residency. - [GitHub repository](https://github.com/melihbirim/corsproxy): MIT-licensed Go implementation of the proxy core. Self-host with `go run main.go`. - [Sign in / create a free account](https://app.corsproxy.dev/auth/login): Free tier is 500 requests/day, no credit card. - [Contact](mailto:contact@corsproxy.dev): For commercial questions, security disclosures, or enterprise needs.