# API CORS Headers Incorrect

**URL:** <https://meta.discourse.org/t/api-cors-headers-incorrect/135155>\
**Category:** Product Support\
**Created:** [December 5, 2019, 2:19pm UTC](https://meta.discourse.org/t/api-cors-headers-incorrect/135155 "2019-12-05T14:19:04Z")\
**Posts on this page:** 1\
**Showing post:** 7

<div class="post-metadata">

**Author:** ![david](https://sea3.discourse-cdn.com/meta/user_avatar/meta.discourse.org/david/32/157490_2.png) [@david](https://meta.discourse.org/u/david)\
**Post date:** [July 4, 2020, 10:12pm UTC](https://meta.discourse.org/t/api-cors-headers-incorrect/135155/7 "2020-07-04T22:12:43Z")

</div>

If you use the user api, you should do it per-user. You should not share keys.

But the most common thing here would be to handle it on the server-side of your app. Your server can send a request using admin API keys without CORS issues, and with fewer security concerns (as long as it’s implemented safely)

---

_[View the full topic](https://meta.discourse.org/t/api-cors-headers-incorrect/135155)._