# CORS Configuration {#cors-configuration}


Cross-Origin Resource Sharing settings for the API.


## Allowed Headers {#allowed-headers}


CORS is configured in the application bootstrap with explicit allowed headers:

```
Authorization, Language, Tenant-Id, Organization-Id,
X-Requested-With, X-Auth-Token, X-HTTP-Method-Override,
Content-Type, Content-Language, Accept, Accept-Language, Observe
```


## Configuration {#configuration}


```typescript
app.enableCors({
  origin: configService.get("CLIENT_BASE_URL"),
  methods: "GET,HEAD,PUT,PATCH,POST,DELETE",
  credentials: true,
  allowedHeaders: [
    "Authorization",
    "Language",
    "Tenant-Id",
    "Organization-Id",
    "X-Requested-With",
    "X-Auth-Token",
    "X-HTTP-Method-Override",
    "Content-Type",
    "Content-Language",
    "Accept",
    "Accept-Language",
    "Observe",
  ],
});
```


## Environment Variables {#environment-variables}


```bash
# Allowed origins (comma-separated for multiple)
ALLOWED_ORIGINS=https://app.gauzy.co,https://demo.gauzy.co,https://stage.gauzy.co
```



> [!IMPORTANT]
> **Important**
>
> For production deployments, set the `ALLOWED_ORIGINS` environment variable to a comma-separated list of allowed origins. Wildcard origins are not used when credentials are enabled.




## Production Setup {#production-setup}


For production, restrict CORS to your domains:

```typescript
app.enableCors({
  origin: ["https://app.yourdomain.com", "https://admin.yourdomain.com"],
  credentials: true,
});
```


## Development {#development}


For development, allow all origins:

```typescript
app.enableCors({
  origin: true, // Allow all origins
  credentials: true,
});
```


## Related Pages {#related-pages}


- [Security Overview](https://sourcey-gauzy.pages.dev/security/security-overview/index.md)
- [Deployment Overview](https://sourcey-gauzy.pages.dev/deployment/deployment-overview/index.md) — production config