Skip to main content

CORS & allowed origins

Publishable keys (kld_pk_live_…) carry an allowed-origins list — the browser origins permitted to use the key. Set it when you mint the key (e.g. https://acme.com, https://app.acme.com); a live publishable key requires at least one. Server keys (kld_sk_live_…) are browser-blocked entirely — they get no CORS grant, so they can only be used server-to-server.

How it's enforced​

  • Preflight (OPTIONS) is permissive — it reflects the requested origin so the browser proceeds (the key isn't presented on a preflight).
  • The real request only gets an Access-Control-Allow-Origin header back when the request Origin is in the key's allowed list. A non-allowlisted origin gets no ACAO header, so the browser blocks the response.

No cookies are involved — the platform API is bearer-token auth, so there is no Access-Control-Allow-Credentials.

Tips​

  • Use bare origins (scheme://host[:port]) — no path, no trailing slash — so they match the browser's Origin header exactly.
  • https is required except for localhost / 127.0.0.1 (local testing).
  • Server-to-server calls with a server key (no browser Origin) aren't CORS-gated, but still authenticate + scope-check normally.