Access to fetch has been blocked by CORS policy
- Browser console
- Any API
What it means
Your page asked a server on another address for data, and that server did not say your site is allowed to read the answer, so the browser blocked it. The request may still have reached the server.
Why it happens
- The API does not send an Access-Control-Allow-Origin header for your site's address.
- The browser's preflight (OPTIONS) request fails, often because the route does not handle OPTIONS.
- The page calls a third-party API straight from the browser that is meant to be called from a server.
How to fix it
- On your own API, allow your exact site address (not *) and answer OPTIONS requests.
- For third-party APIs with secret keys, call them from your server instead of the browser.
- Do not install a 'disable CORS' browser extension or proxy: it only hides the problem on your machine.
Let your AI find the cause
Paste this into Claude Code, Cursor, Lovable or whichever AI built your app. It looks first and changes nothing until you have read the answer.
My app shows 'blocked by CORS policy' in the browser console. Without changing anything yet, find the request that fails, the server it calls, and where that server sets CORS headers. Tell me whether this call should happen in the browser at all, and propose a fix that allows only my site's address.