CORS Header Generator

Generate Nginx / Apache CORS config and a matching fetch() example from your settings.

Private by design. Every tool runs 100% in your browser — your code, text, and tokens never leave your device. Nothing is uploaded or stored.

Allow-Origin

Allow-Methods

Allow-Headers

Max-Age (s)

Allow-Credentials

If Allow-Credentials is true, Allow-Origin must be the exact origin (not *). Copy the block into your server config.

Nginx

location /api/ {
    add_header 'Access-Control-Allow-Origin' 'https://app.example.com' always;
    add_header 'Access-Control-Allow-Methods' 'GET, POST' always;
    add_header 'Access-Control-Allow-Headers' 'Content-Type, Authorization' always;
    add_header 'Access-Control-Max-Age' '600' always;
    if ($request_method = 'OPTIONS') { return 204; }
}

Apache

<IfModule mod_headers.c>
    Header always set Access-Control-Allow-Origin "https://app.example.com"
    Header always set Access-Control-Allow-Methods "GET, POST"
    Header always set Access-Control-Allow-Headers "Content-Type, Authorization"
    Header always set Access-Control-Max-Age "600"
</IfModule>

Browser fetch

fetch('https://api.example.com/data', {
  method: 'GET',
  headers: { 'Content-Type': 'application/json' },
  credentials: 'omit'
});

Frequently Asked Questions

When do I need Access-Control-Allow-Credentials?

Only when the request sends cookies or HTTP auth. If you set credentials: include on the client, the server must echo Allow-Credentials: true and cannot use a wildcard origin.

Why is a wildcard origin rejected with credentials?

For security, a * origin cannot be combined with credentialed requests. You must echo back the exact requesting origin instead of the wildcard.

Do preflight OPTIONS requests need these headers too?

Yes. The browser sends an OPTIONS preflight first; your server must answer it with the CORS headers and a 204, or the actual request is never sent.