j1.1.0
API Overview
The CORS Preferences API allows you to manage your Cross-Origin Resource Sharing (CORS) preferences.
By specifying which domains are permitted to access a site, you can define exceptions to the same-site policy that browsers would otherwise enforce.
Authentication & Authorization
For resource access, you must use a client ID and client secret from Account Manager to request an access token. The access token is used as a bearer token and added to the Authorization header of your API request.
You must include sfcc.cors-preferences.rw (read-write access) or sfcc.cors-preferences (read-only access) in the client ID used to generate the token. For a full list of permissions, see the Authorization Scopes Catalog.
For detailed setup instructions, see the Authorization for Admin APIs.
Use Cases
Manage CORS configuration
You can use the preferences/cors endpoint to retrieve, set, or delete your configuration for CORS origins.
Usage Notes
- This configuration is made per client ID and site.
- All known domain names and aliases are added to the list automatically and do not need to be configured for CORS explicitly.
- If a configuration is absent, CORS will not be active. To enable cors for a client without specifying custom origins, configure the client and site with an empty origin list. The known domain names and aliases will still apply.
Let us know so we can improve!