Supabase: CORS errors from browser [2026 fix]
Browser blocks Supabase requests due to missing CORS headers in project settings. Add your domain to Supabase Auth Allowed Redirect URLs and enable CORS in project config.
Supabase CORS Errors from Browser – Production Fix
TL;DR
Cause: Your frontend domain isn't registered in Supabase's CORS allowlist, so the browser blocks cross-origin requests. Fix: Add your domain to Supabase Auth settings → Allowed Redirect URLs + verify CORS headers in project configuration.---
Real Console Error Messages
Here are the exact errors you'll see in Chrome/Firefox DevTools Console:
``` 1. Access to XMLHttpRequest at 'https://your-project.supabase.co/auth/v1/signup' from origin 'https://yourdomain.com' has been blocked by CORS policy: Response to preflight request doesn't pass access control check: No 'Access-Control-Allow-Origin' header is present on the requested resource.
2. CORS error: Cross-Origin Request Blocked: The Same Origin Policy disallows reading the remote resource at https://your-project.supabase.co/rest/v1/users. (Reason: CORS header 'Access-Control-Allow-Origin' missing). Status code: (null).
3. Fetch failed: TypeError: Failed to fetch (This occurs when preflight OPTIONS request is rejected)
4. Access to XMLHttpRequest at 'https://your-project.supabase.co/functions/v1/my-function' from origin 'https://yourdomain.com' has been blocked by CORS policy: The value of the 'Access-Control-Allow-Credentials' header in the response is '' which must be 'true' when the request's credentials mode (include) is 'include'.
5. No 'Access-Control-Allow-Origin' header is present on the requested resource. If an opaque response serves your needs, set the request's mode to 'no-cors' to fetch the resource with CORS disabled. ```
---
Broken Code vs. Fixed Code
Problem: Missing Domain Registration
BROKEN: ```javascript // Frontend code at https://yourdomain.com import { createClient } from '@supabase/supabase-js'
const supabase = createClient( 'https://your-project.supabase.co', 'your-anon-key' )
// This call fails with CORS error await supabase.auth.signUp({ email: 'user@example.com', password: 'password123' }) ```
FIXED: ```javascript // Same frontend code works after configuration // No code changes needed! Just update Supabase settings:
// In Supabase Dashboard: // 1. Go to Project Settings → Authentication → URL Configuration // 2. Add to "Allowed Redirect URLs": // https://yourdomain.com // https://www.yourdomain.com // http://localhost:3000 (for dev)
// Code remains identical: import { createClient } from '@supabase/supabase-js'
const supabase = createClient( 'https://your-project.supabase.co', 'your-anon-key' )
await supabase.auth.signUp({ email: 'user@example.com', password: 'password123' }) ```
Problem: Missing Credentials in Fetch
BROKEN:
```javascript
// Custom fetch to Supabase without credentials
const response = await fetch(
'https://your-project.supabase.co/rest/v1/users',
{
method: 'GET',
headers: {
'Authorization': Bearer ${token}
}
}
)
```
FIXED:
```javascript
// Add credentials mode
const response = await fetch(
'https://your-project.supabase.co/rest/v1/users',
{
method: 'GET',
credentials: 'include', // Enable credentials
headers: {
'Authorization': Bearer ${token},
'Content-Type': 'application/json'
}
}
)
```
---
Step-by-Step Fix for Production
1. Log into Supabase Dashboard → Your Project 2. Go to Settings (gear icon, bottom left) 3. Click "Authentication" tab 4. Find "URL Configuration" section 5. Paste your production domains in "Allowed Redirect URLs": ``` https://yourdomain.com https://www.yourdomain.com https://api.yourdomain.com (if applicable) ``` 6. Save changes (auto-saves, but give it 30 seconds to propagate) 7. Hard refresh your browser (Cmd+Shift+R or Ctrl+Shift+R) to clear cache 8. Test the request in DevTools Console
Uncertainty note: CORS propagation timing varies by Supabase infrastructure region. Some regions apply changes instantly; others take up to 2 minutes. If still broken after 5 minutes, try a different browser to rule out local cache.
---
Still Broken? Check These Too
1. [Verify your Supabase API Key permissions](/?guide=supabase-auth-keys) – Anon keys have restricted scope. Check Row Level Security (RLS) policies aren't blocking requests. Use your service role key only server-side.
2. [Check if you're using the wrong project URL](/?guide=supabase-multiple-projects) – Verify NEXT_PUBLIC_SUPABASE_URL matches your actual project URL. Copy-paste from Supabase Settings → API to avoid typos.
3. Custom headers or middleware interfering – If using NextJS API routes or Nginx, ensure they're not stripping CORS headers. Add Access-Control-Allow-Origin: * headers at the application level if proxying Supabase.
---
Official Resources
---
Found a different variation? Drop it in the comments – Whether you hit this on Vercel edge functions, Expo mobile, or a GraphQL gateway, let the community know your exact error and fix.