Open source
MIT licensed- Self-host a simpler Go relay anywhere
- No quotas, no API keys, no accounts
- Run alongside your other infra
- One-click deploy: Railway, Render, Fly, Koyeb
- Source on GitHub
Managed relay + open-source relay
Ship browser integrations
without the proxy work.
A managed relay for the third-party APIs your frontend has to call, with API keys, rate limits, logs, and a dashboard out of the box. Need to self-host? A simpler open-source relay is on GitHub.
Fix CORS without shipping a throwaway backend. Free tier, no credit card.
Managed
Use the hosted API
Sign in, create an API key, and start sending requests through the hosted proxy with usage tracking and daily limits.
curl -H "X-API-Key: sk_live_..." \
"https://api.corsproxy.dev/proxy?url=https://api.github.com/users/octocat"
# Browser-friendly form
https://api.corsproxy.dev/proxy?url=https://api.github.com/users/octocat&key=sk_live_...Self-hosted
Run the Go binary
A simpler, separate CORS relay (not the hosted service's code): one Go program, no external dependencies, no keys or quotas. Deploys to Railway, Render, Fly, or your own box.
git clone https://github.com/melihbirim/corsproxy
cd corsproxy
go run main.go # listens on :8080What you get
Keep API secrets out of the browser
Store a provider key (OpenAI, Notion, Stripe…) on your corsproxy.dev key once. We add it only to requests for the host and path you choose, so it never ships in frontend code. Managed upstream headers →
Remote MCP server for AI agents
Give Claude Code, Cursor, and other agents safe API access over Streamable HTTP: SSRF blocked, hard quotas, secrets injected server-side. How it works →
Edge caching
Add ttl=300 to a GET and repeat calls are served from Cloudflare's edge, with an X-Cache: HIT header. Cache entries are private to your key. Pro plan. Caching →
Header overrides
Set or strip headers per request with reqHeaders and resHeaders. Same syntax as corsproxy.io, so switching is copy-paste. Header overrides →
Locked down by default
Lock each key to one custom origin (Free keys also always allow localhost for development). Requests to private networks and cloud metadata are refused, and upstream cookies are stripped.
Exact quotas, no surprises
Daily limits enforced atomically per account, with X-RateLimit-* headers on every proxied response and an email the day you hit the limit.
Logs and usage
Your last 100 calls in the dashboard with status, timing, and size, plus 30 days of history and per-key usage.
GET and POST, any file
GET and POST requests (PUT, PATCH and DELETE are not supported). JSON, images, PDFs, and other files pass through byte-for-byte, up to 10 MB per response.
Open-source relay
A separate, simpler CORS relay written in Go and MIT-licensed. Self-host it on Railway, Render, Fly, or your own server when you need full control.
Privacy built in
Data export anytime. Deleting your account stops access immediately; data is kept 30 days for abuse investigations, then permanently purged.
Two ways to use it
Managed API
Free tier available- No infra to maintain (no SLA on Free/Pro; Enterprise SLA)
- Origin-locked API keys, exact daily quotas, SSRF protection
- Secrets kept server-side with managed upstream headers
- Edge caching (
ttl) and header overrides - Dashboard with your last 100 calls and per-key usage
- Free: 500 req/day. Pro: $5/month for 20,000/day
From the blog
All posts →Tutorial
Why am I getting a CORS error?
What the browser is actually doing, why your server "refuses" to respond, and three concrete ways to fix it.
Security
How a CORS proxy can be abused
SSRF, credential laundering, bandwidth burn. The threat model and the mitigations corsproxy.dev applies.
How-to
5 ways to fix CORS in development
Vite proxy, webpack dev-server, server-side headers, the disabled-security browser, and a CORS proxy.
Developer tools
All docs →OpenAPI 3.1
Machine-readable contract for every endpoint. Drop into Stoplight, Swagger UI, Insomnia, or a code generator.
openapi.yaml →Postman collection
Import directly. Set api_key and origin and you're calling the proxy and MCP endpoints.
System status
Live health probes of the API worker, marketing site, dashboard, and Cloudflare edge, checked from your network.
corsproxy.dev/status →