# Acess-Control-Allow-Headers CORS Error with API after updating discourse

**URL:** <https://meta.discourse.org/t/acess-control-allow-headers-cors-error-with-api-after-updating-discourse/147716>\
**Category:** Product Support\
**Created:** [April 12, 2020, 4:51pm UTC](https://meta.discourse.org/t/acess-control-allow-headers-cors-error-with-api-after-updating-discourse/147716 "2020-04-12T16:51:16Z")\
**Posts on this page:** 1\
**Showing post:** 1

<div class="post-metadata">

**Author:** ![pablogg](https://sea3.discourse-cdn.com/meta/user_avatar/meta.discourse.org/pablogg/32/164759_2.png) [@pablogg](https://meta.discourse.org/u/pablogg)\
**Post date:** [April 12, 2020, 4:51pm UTC](https://meta.discourse.org/t/acess-control-allow-headers-cors-error-with-api-after-updating-discourse/147716/1 "2020-04-12T16:51:16Z")

</div>

I upgrade discourse yesterday and I get all the API callbacks with error I have found that the problem is the autentications headers (1) but I trying with some calls and I get this error:

`Access to XMLHttpRequest at 'https://mydomain.com/notifications.json?username=admin' from origin 'https://mydomain.com' has been blocked by CORS policy: Request header field api-username is not allowed by Access-Control-Allow-Headers in preflight response.`

I using Vue and I have added the api-key and api-username to the heades like this:

```
Vue.http
        .get(
             "https://discourse.mydomain.com/notifications.json?username="+input.username,
          {
            headers: {
             "Api-Key":"xxxxxxxxxxxxxxxxx",
             "Api-Username": "system",
              "content-type": "application/json",
              accept: "application/json"
            }
          }
        )

```

(1) [Discourse REST API Documentation](https://meta.discourse.org/t/discourse-api-documentation/22706)

---

_[View the full topic](https://meta.discourse.org/t/acess-control-allow-headers-cors-error-with-api-after-updating-discourse/147716)._