# CORS error accessing API from javascript application

**URL:** https://meta.discourse.org/t/cors-error-accessing-api-from-javascript-application/128785
**Category:** Development
**Created:** [September 17, 2019, 12:49pm UTC](https://meta.discourse.org/t/cors-error-accessing-api-from-javascript-application/128785 "2019-09-17T12:49:29Z")
**Posts on this page:** 1
**Showing post:** 4

<div class="post-metadata">

### Author: ![david](https://sea3.discourse-cdn.com/meta/user_avatar/meta.discourse.org/david/32/157490_2.png) [@david](https://meta.discourse.org/u/david)
#### Post date: [September 17, 2019, 1:09pm UTC](https://meta.discourse.org/t/cors-error-accessing-api-from-javascript-application/128785/4 "2019-09-17T13:09:10Z")

</div>

> [@Improve BAD CSRF error message when making API calls with content-type application/json](https://meta.discourse.org/t/improve-bad-csrf-error-message-when-making-api-calls-with-content-type-application-json/117136/8):
>
> the accepted headers are always “User-Api-Key” and “User-Client-Id” instead of “Api-Key” and “Api-Username”

`user-api-key` and `user-client-id` are a completely different method of authentication. Regular API keys won’t work with those headers. What happens when you use the correct header names? (`api-key` and `api-username`)

---

_[View the full topic](https://meta.discourse.org/t/cors-error-accessing-api-from-javascript-application/128785)._