# Acess-Control-Allow-Headers CORS Error with API after updating discourse

**URL:** https://meta.discourse.org/t/acess-control-allow-headers-cors-error-with-api-after-updating-discourse/147716
**Category:** Support
**Created:** [April 12, 2020, 4:51pm UTC](https://meta.discourse.org/t/acess-control-allow-headers-cors-error-with-api-after-updating-discourse/147716 "2020-04-12T16:51:16Z")
**Posts on this page:** 1
**Showing post:** 7

<div class="post-metadata">

### Author: ![blake](https://sea3.discourse-cdn.com/meta/user_avatar/meta.discourse.org/blake/32/157322_2.png) [@blake](https://meta.discourse.org/u/blake)
#### Post date: [April 12, 2020, 6:24pm UTC](https://meta.discourse.org/t/acess-control-allow-headers-cors-error-with-api-after-updating-discourse/147716/7 "2020-04-12T18:24:26Z")

</div>

You really should not be using these API credentials for CORS requests which is why that header field is not allowed.

> [@CORS error accessing API from javascript application](https://meta.discourse.org/t/cors-error-accessing-api-from-javascript-application/128785/6):
>
> Oh, so you are trying to make this request from a client-side javascript application? That is not permitted for numerous reasons. For example, if you include an admin API key in the source code of your javascript app, any user could gain full admin access to your forum. [Here is](https://meta.discourse.org/t/what-are-the-risks-of-enabling-cross-origin-resource-sharing-discourse-enable-cors/41248) a previous topic on the subject.

However we do allow the [user-api](https://meta.discourse.org/t/user-api-keys-specification/48536) headers in CORS:

> [@Request header field User-Api-Key is not allowed by Access-Control-Allow-Headers](https://meta.discourse.org/t/request-header-field-user-api-key-is-not-allowed-by-access-control-allow-headers/92662/4):
>
> I’m trying to post comments to my Discourse instance from another web application using user api keys. I managed to get the user key following the method described in your [original topic](https://meta.discourse.org/t/user-api-keys-specification/48536) and this [other useful discussion](https://meta.discourse.org/t/generating-user-api-keys-with-rest-api/61916). After getting the key, when I send it along with my requests as a value of the User-Api-Key header, I get the Request header field User-Api-Key is not allowed by Access-Control-Allow-Headers error. As I [asked in my PR](https://github.com/discourse/discourse/pull/6107#issuecomment-406568320), I’m not sure if it’s enough to add the headers in the file…

---

_[View the full topic](https://meta.discourse.org/t/acess-control-allow-headers-cors-error-with-api-after-updating-discourse/147716)._