CORS blocked it
What is this error?
Your server answered, but did not say your website is allowed to read the answer, so the browser threw it away. The block happens in the browser, on purpose.
Common Causes
- The API does not send an Access-Control-Allow-Origin header for your domain.
- You are calling from a preview domain the API doesn't list.
- A preflight OPTIONS request is not handled by the server.
- You are calling a third-party API directly from the browser that expects server-to-server calls.
How to fix it (Check First)
- 1Network tab → look for an OPTIONS request before the failing one.
- 2Check the response headers of the failing call.
- 3If it's a third-party API with a secret key, it belongs behind your own server anyway.
What NOT to do
- Do not disable web security in your browser and call it fixed — real visitors still fail.
- Do not set Allow-Origin: * on an endpoint that returns private data.
Technical Details
CORS is enforced by the browser using response headers. Non-simple requests trigger a preflight OPTIONS that must return the allowed origin, methods and headers before the real request is sent.