Fix · Supabase and databases

CORS error when my website calls Supabase or an Edge Function

Blocks your work

What you may see

The console says blocked by CORS policy
A request works in a tool like Postman but not in the browser

Most likely cause

A browser asks the server first whether your website's address may call it; the server answered without the allow headers, or the real error hides behind the CORS message.

Check first (about two minutes)

Open the browser network tab: is there an OPTIONS request first, and what status does it have?
Check the real status of the second request: a 401, 404 or 500 often shows up as CORS.

The fix prompt

What you type here never leaves your browser. The search runs on this page, and nothing is sent to a server or to an AI.

The exact error or what you see

What you did before it happened

Kept only in this browser, on this device. Keys and passwords are removed before anything is saved.

Prompt language

You are a careful senior engineer who knows Supabase (database, login and file storage) and explains it to people who are not developers. I am not a developer, so explain every step in plain words and tell me exactly which button, menu or command you mean. If you are not sure about something, say so; do not guess.

THE PROBLEM
CORS error when my website calls Supabase or an Edge Function

THE EXACT ERROR OR WHAT I SEE
[paste the exact error here]

WHAT I DID BEFORE IT HAPPENED
[write in a few words what you did before it happened]

MOST LIKELY CAUSE
A browser asks the server first whether your website's address may call it; the server answered without the allow headers, or the real error hides behind the CORS message.

DO THESE STEPS, IN THIS ORDER
1. Find which address the browser calls and what the OPTIONS answer is.
2. For Supabase's own data API, check the project address and keys are right (a wrong address looks like CORS).
3. For an Edge Function or my own server route, add an OPTIONS handler and the allow headers (origin, headers, methods) to EVERY response, including errors.
4. Allow only my site addresses, not a star for everyone.
Stop and tell me if what you see does not match a step. Do not skip ahead.

CHECK THAT IT WORKED
- The OPTIONS request answers 200/204 with the headers and the real request succeeds.
Tell me exactly what I should see on the screen when it works.

DO NOT CHANGE
- Do not install a browser extension that turns CORS off, as a fix.
- Anything I did not ask about: the design, the text, other pages, other settings or the data.
- Do not delete files, data or branches, do not reset or force-push, and do not rewrite history, unless you first show me exactly what would be lost and I say yes.
- Do not paste, print or ask me to paste a password or secret key into this chat. If one is needed, tell me which settings page of the right service to store it in.

WHEN YOU FINISH
Explain in simple words what you changed (file by file or setting by setting), why you changed it, and how I can undo it.

Paste it into Claude, ChatGPT, Gemini or Cursor, then follow what it says.

After you tried it, did it work?

Steps

Find which address the browser calls and what the OPTIONS answer is.
For Supabase's own data API, check the project address and keys are right (a wrong address looks like CORS).
For an Edge Function or my own server route, add an OPTIONS handler and the allow headers (origin, headers, methods) to EVERY response, including errors.
Allow only my site addresses, not a star for everyone.

Do not do this

Do not set the allowed origin to * for functions that use cookies or private data.
Do not install a browser extension that turns CORS off, as a fix.

Try another entry