Free CORS Checker API - Test Headers

Parameters

name	in	type	required	description
`url`	query	string	required	URL to check for CORS headers
`origin`	query	string	optional	Origin to send in the preflight request default `https://example.com`

Request

Send your key in the X-API-Key header. More languages and patterns live on the code examples page.

curl -s "https://apixies.io/api/v1/check-cors?url=https%3A%2F%2Fapi.github.com" \
  -H "X-API-Key: YOUR_API_KEY"

const res = await fetch("https://apixies.io/api/v1/check-cors?url=https%3A%2F%2Fapi.github.com", {
  headers: { "X-API-Key": "YOUR_API_KEY" }
});
const data = await res.json();
console.log(data);

$ch = curl_init("https://apixies.io/api/v1/check-cors?url=https%3A%2F%2Fapi.github.com");
curl_setopt_array($ch, [
    CURLOPT_RETURNTRANSFER => true,
    CURLOPT_HTTPHEADER => ["X-API-Key: YOUR_API_KEY"],
]);
$data = json_decode(curl_exec($ch), true);
curl_close($ch);

print_r($data);

import requests

res = requests.get(
    "https://apixies.io/api/v1/check-cors",
    params={"url": "https://api.github.com"},
    headers={"X-API-Key": "YOUR_API_KEY"},
)
print(res.json())

Response

The result sits under data in the standard envelope. See the response format guide for errors and status codes.

returns

data.cors_enabled: True when the server sends Access-Control-Allow-Origin.
data.headers: The CORS headers the server sent, null when missing.
data.analysis: Allowed origins, methods and headers, plus security notes.
data.preflight_status: HTTP status of the OPTIONS preflight request.

example response 200

{
    "status": "success",
    "http_code": 200,
    "code": "SUCCESS",
    "message": "CORS check completed",
    "data": {
        "url": "https://api.github.com",
        "cors_enabled": true,
        "preflight_status": 204,
        "headers": {
            "access_control_allow_origin": "*",
            "access_control_allow_methods": "GET, POST, PUT, DELETE, OPTIONS",
            "access_control_allow_headers": "Content-Type, Authorization, Accept",
            "access_control_max_age": "86400",
            "access_control_allow_credentials": null,
            "access_control_expose_headers": null
        },
        "analysis": {
            "allows_any_origin": true,
            "allows_credentials": false,
            "allowed_methods": [
                "GET",
                "POST",
                "PUT",
                "DELETE",
                "OPTIONS"
            ],
            "allowed_headers": [
                "Content-Type",
                "Authorization",
                "Accept"
            ],
            "max_age_seconds": 86400,
            "security_notes": [
                "Wildcard origin (*) allows any website to make requests",
                "Credentials are not allowed, which is correct when using wildcard origin"
            ]
        }
    }
}

Authentication and limits

This endpoint needs an API key. Use the sandbox ("try it" above) to test it without registering. See the authentication guide for details.

Standard rate limits apply to this endpoint.

related endpoints

GET SSL Health Inspector Inspect SSL certificate details for a domain, including validity, expiry and chain health GET Security Headers Inspector Inspect security headers for a URL to check for adherence to current best practices GET Email Inspector Inspect email address details including format validation, MX record checks, and disposable email de... GET User Agent Inspector Parse a User-Agent string to detect browser, operating system, device type and bot status

getting started

authentication code examples response format

explore

all api endpoints guides and tutorials online tools

resources

homepage changelog suggest an endpoint

Get a free API key

A temporary key takes one click and no signup. Register and you get 75 requests/day. Free tier is for development & small projects.

get a temporary key create an account