# API CORS Headers Incorrect

**URL:** <https://meta.discourse.org/t/api-cors-headers-incorrect/135155>\
**Category:** Product Support\
**Created:** [December 5, 2019, 2:19pm UTC](https://meta.discourse.org/t/api-cors-headers-incorrect/135155 "2019-12-05T14:19:04Z")\
**Posts on this page:** 1\
**Showing post:** 9

<div class="post-metadata">

**Author:** ![gezquinn](https://avatars.discourse-cdn.com/v4/letter/g/ce73a5/32.png) [@gezquinn](https://meta.discourse.org/u/gezquinn)\
**Post date:** [July 5, 2020, 9:09pm UTC](https://meta.discourse.org/t/api-cors-headers-incorrect/135155/9 "2020-07-05T21:09:40Z")

</div>

Hi @david, I’ve tried to implement a backend solution but when I call `https://example.com/users/by-external/{EXTERNAL_USER_ID}.json?api_key={DISCOURSE_API_KEY}&api_username=system`, the response i get is the html for the sign in page (I’m guessing it’s redirecting there). I have `login required` enabled and when I disable it, I get the correct JSON response. I want to keep that setting enabled - any ideas what’s going on?

---

_[View the full topic](https://meta.discourse.org/t/api-cors-headers-incorrect/135155)._