Supabase: CORS errors from browser [2026 fix]
Browser blocks requests to Supabase API due to missing CORS headers; whitelist your domain in project settings.
Supabase: CORS errors from browser [2026 fix]
TL;DR
Cause: Your browser is blocking requests to Supabase because your domain isn't whitelisted in the CORS configuration.
Fix: Add your domain to Supabase project settings → Authentication → URL Configuration → Redirect URLs.
---
Real Console Error Messages
You'll see one of these exact errors at 2am when everything breaks:
``` Access to XMLHttpRequest at 'https://your-project.supabase.co/auth/v1/signup' from origin 'http://localhost:3000' has been blocked by CORS policy: No 'Access-Control-Allow-Origin' header is present on the requested resource. ```
``` Failed to load resource: the server responded with a status of 403 (Forbidden) Response headers are missing required 'Access-Control-Allow-Origin' ```
``` CORS error: Cross-Origin Request Blocked: The Same Origin Policy disallows reading the remote resource at https://your-project.supabase.co/rest/v1/users. (Reason: CORS request did not succeed). ```
``` Typo/Network error: Error: Failed to fetch at Auth.signUp (supabase.js:123) at async handleSignup (app.js:45) ```
``` No 'Access-Control-Allow-Credentials' header in response when credentials mode is 'include' ```
---
Broken vs Fixed Code
❌ BROKEN: Missing Domain Configuration
```javascript // app.js - your frontend code const { data, error } = await supabase.auth.signUp({ email: 'user@example.com', password: 'secure123' }); // Browser blocks this → CORS error // Your Supabase project has NO redirect URLs configured ```
Root Issue: Supabase project settings have empty URL Configuration.
✅ FIXED: Whitelist Your Domain
Step 1: Update Supabase Project Settings
Go to your Supabase dashboard:
1. Navigate to Authentication (left sidebar)
2. Click URL Configuration
3. Under "Redirect URLs" add:
- http://localhost:3000 (development)
- https://yourapp.com (production)
- https://www.yourapp.com (if applicable)
4. Click Save
Step 2: Code Stays the Same
Your client code doesn't change—the fix is purely configuration:
```javascript // app.js - EXACT SAME CODE now works const { data, error } = await supabase.auth.signUp({ email: 'user@example.com', password: 'secure123' }); // Now browser allows this → CORS headers present // Request succeeds ✓ ```
Alternative: Environment-Based URLs
For multiple environments, use environment variables:
```javascript // config.js const SUPABASE_REDIRECT_URLS = process.env.NODE_ENV === 'production' ? 'https://yourapp.com' : 'http://localhost:3000';
// ⚠️ This variable helps YOU remember what to add to dashboard // Still must manually add to Supabase URL Configuration ```
---
Common Variations & Fixes
Issue: Wildcard Domain Doesn't Work
Don't use: https://*.example.com
Subabase CORS doesn't support wildcards. Add each subdomain explicitly: ``` https://app.example.com https://admin.example.com https://api.example.com ```
Issue: Localhost Works, Production Doesn't
You added http://localhost:3000 but forgot to add production URL. Add:
```
https://yourdomain.com
```
Issue: Port Number Matters
``` http://localhost:3000 ← different from http://localhost:3001 ← this one ```
Add the exact port your app runs on.
---
Still broken? Check these too
1. [Supabase Auth Configuration Guide](/?guide=supabase-auth) — Verify your auth settings aren't blocking the request at the policy level. Some projects have restrictive JWT rules that appear as CORS errors.
2. [Browser DevTools Network Tab Debugging](/?guide=network-debugging) — Inspect the actual response headers. Look for Access-Control-Allow-Origin header. If missing, it's definitely a Supabase config issue.
3. [Local Development vs Deployed App — Environment Differences](/?guide=env-differences) — Your localhost works but production fails? Check that BOTH URLs are in Supabase redirect settings. Verify no proxy/CDN is stripping headers.
---
Version Note
This guide applies to Supabase JS client v2.38.0+ (2024-2026). We cannot guarantee behavior for older versions—if you're on v1.x, check the [official Supabase documentation](https://supabase.com/docs/guides/auth/auth-cors). The URL Configuration interface has remained stable, but authentication flow details may vary.
---
Quick Checklist
---
Official Resources
📖 [Supabase Authentication Documentation](https://supabase.com/docs/guides/auth) — Full reference for URL configuration and CORS handling.
---
Found a different variation? Drop it in the comments—CORS errors are environment-specific, and your edge case helps others.