CORS & Allowed Origins

ZodBack implements dynamic CORS (Cross-Origin Resource Sharing) for public API endpoints. This allows external websites to securely access your data.

How It Works

1. Pre-flight request: Browser sends an OPTIONS request with the Origin header
2. Origin validation: The CORS middleware checks if the path is a public endpoint
3. Token lookup: For public paths, the middleware extracts the API token and looks up its allowed origins
4. Allow or deny: If the origin matches an allowed origin for that token, CORS headers are set

Public Paths

The following path prefixes are treated as public and support CORS:

Portfolio

• /api/portfolio/v1/public/*
• /api/portfolio/public/*
• /portfolio/v1/public/*
• /portfolio/public/*

Documentation

• /api/docs/v1/public/*
• /api/docs/public/*
• /docs/v1/public/*
• /docs/public/*

Configuration

Step 1: Create a Token with Allowed Origins

In the dashboard, navigate to API Tokens and create a token with your site's origin:

Allowed Origins: https://mysite.com, https://docs.mysite.com

Step 2: Use the Token from Your Site

// From https://mysite.com
fetch('https://api.zodback.com/api/portfolio/v1/public/all', {
  headers: {
    'Authorization': 'Bearer your-token',
  },
})

The browser automatically includes the Origin: https://mysite.com header, which the CORS middleware validates.

Troubleshooting

"CORS error" in browser console

• Verify the token's allowed origins include your exact domain (with protocol)
• Check that the API token is valid and not expired
• Ensure you're using the correct public endpoint path

"401 Unauthorized"

• Check the Authorization header format: Bearer <token>
• Ensure the token belongs to the correct project

"403 Forbidden"

• The origin is not in the token's allowed origins list
• Update the token's allowed origins in the dashboard