Request header field X is not allowed by Access-Control-Allow-Headers in preflight response

Your request sends a header (often authorization, content-type: application/json or x-api-key) that the preflight's Access-Control-Allow-Headers doesn't list.

Fix

Access-Control-Allow-Headers: Content-Type, Authorization, X-Api-Key

• Names are case-insensitive. List every custom header the client sends.
• * works only without credentials, and it never covers Authorization. Name it explicitly.
• Not sure what the browser asks for? Read Access-Control-Request-Headers on the OPTIONS request in DevTools.

Want every stack fixed at once? The CORS Fix Kit ($9) includes the cors-doctor CLI plus tested configs for 13 stacks.

Reference

MDN: Cross-Origin Resource Sharing

Independent pages, not affiliated with or endorsed by any vendor mentioned.