# API CORS Headers Incorrect

**URL:** <https://meta.discourse.org/t/api-cors-headers-incorrect/135155>\
**Category:** Product Support\
**Created:** [December 5, 2019, 2:19pm UTC](https://meta.discourse.org/t/api-cors-headers-incorrect/135155 "2019-12-05T14:19:04Z")\
**Posts on this page:** 1\
**Showing post:** 1

<div class="post-metadata">

**Author:** ![jessicat](https://avatars.discourse-cdn.com/v4/letter/j/c68b51/32.png) [@jessicat](https://meta.discourse.org/u/jessicat)\
**Post date:** [December 5, 2019, 2:19pm UTC](https://meta.discourse.org/t/api-cors-headers-incorrect/135155/1 "2019-12-05T14:19:04Z")

</div>

Hi,

I am having an issue with embedding discourse in our intranet site.

The API documentation states the discourse request requires the headers “API-Key” and “Api-Username” to authenticate and gain access to the feed. However the Pre-flight check says that “User-API-Key”, “User-Api-Client-Id” are the allowed values.

When called not through a browser this work as expected. But when calling through the browser the server is claiming it requires “User-API-Key”, “User-Api-Client-Id”.

I checked basic connection worked with PostMan this behaves as per the discourse docs

If we pass the Headers from the Docs the browser blocks the request due to Pre-flight check and gets a Access-Control-Allow-Headers CORS error.

If we pass the headers the server will accept we get a “not authorised error” because the application expects differently named values.

I have tried adding headers to the docker config but it doesn’t seem to apply. The CORS enabled and origin of ‘\*’ is in the config.

Can anyone advise?

Thanks,  
Jessica

---

_[View the full topic](https://meta.discourse.org/t/api-cors-headers-incorrect/135155)._