# CORS error accessing API from javascript application

**URL:** https://meta.discourse.org/t/cors-error-accessing-api-from-javascript-application/128785
**Category:** Development
**Created:** [September 17, 2019, 12:49pm UTC](https://meta.discourse.org/t/cors-error-accessing-api-from-javascript-application/128785 "2019-09-17T12:49:29Z")
**Posts on this page:** 1
**Showing post:** 8

<div class="post-metadata">

### Author: ![david](https://sea3.discourse-cdn.com/meta/user_avatar/meta.discourse.org/david/32/157490_2.png) [@david](https://meta.discourse.org/u/david)
#### Post date: [September 17, 2019, 1:22pm UTC](https://meta.discourse.org/t/cors-error-accessing-api-from-javascript-application/128785/8 "2019-09-17T13:22:04Z")

</div>

This isn’t a restriction specific to Discourse - in general it is a bad idea to include admin credentials in the source code of a website.

If you can make the Discourse API call from your node.js server, that would probably be the best solution. If you need your application to be purely client-side, then requesting user-specific api keys is an option, although their setup is a lot more complex: [User API keys specification](https://meta.discourse.org/t/user-api-keys-specification/48536)

---

_[View the full topic](https://meta.discourse.org/t/cors-error-accessing-api-from-javascript-application/128785)._