# CORS issue when making an API call

**URL:** <https://devforum.zoom.us/t/cors-issue-when-making-an-api-call/108394>\
**Category:** Zoom Apps\
**Tags:** api\
**Created:** [April 22, 2024, 9:44am UTC](https://devforum.zoom.us/t/cors-issue-when-making-an-api-call/108394 "2024-04-22T09:44:41Z")\
**Posts on this page:** 5\
**Page:** 1

<div class="post-metadata">

**Author:** ![viral.webosmotic](https://sea2.discourse-cdn.com/flex016/user_avatar/devforum.zoom.us/viral.webosmotic/32/58933_2.png) [@viral.webosmotic](https://devforum.zoom.us/u/viral.webosmotic)\
**Post date:** [April 22, 2024, 9:44am UTC](https://devforum.zoom.us/t/cors-issue-when-making-an-api-call/108394/1 "2024-04-22T09:44:41Z")

</div>

I am creating one Zoom app, which is basically a react app, where on one page I am making a user log in, Now when I send a login call to my server, it returns with CORS error, I created a demo server locally with no CORS configuration, but the result remains same, I tried with some open APIs, still result remains same. Kind of making any request and the server is responding with CORS. How to fix this issue ?

---

<div class="post-metadata">

**Author:** ![gabewells](https://sea2.discourse-cdn.com/flex016/user_avatar/devforum.zoom.us/gabewells/32/53478_2.png) [@gabewells](https://devforum.zoom.us/u/gabewells)\
**Post date:** [April 22, 2024, 9:32pm UTC](https://devforum.zoom.us/t/cors-issue-when-making-an-api-call/108394/2 "2024-04-22T21:32:39Z")

</div>

Hi Viral - I had a similar experience. I had to setup a CSP (Content Security Policy) to allowlist URLs so that they wouldn’t be blocked. For example, I used firebase for my backend and had to add the needed URLs to the hosting headers.

example:

“hosting”: {

```
    "public": "dist",
    "headers": [
{
	"source": "**",
	"headers": [
		{
			"key": "X-Content-Type-Options",
			"value": "nosniff"
		},
		{
			"key": "Content-Security-Policy",
			"value": "default-src 'self' data: https://xxxxx.web.app https://identitytoolkit.googleapis.com https://securetoken.googleapis.com; etc...."
		},
		{
			"key": "Referrer-Policy",
			"value": "same-origin"
		}
	]
}

```

],

Also, make sure that when you are making any external api calls that it is coming from your server app and not your zoom app. zoom apps do not allow outside api calls.

Hope this helps.

---

<div class="post-metadata">

**Author:** ![viral.webosmotic](https://sea2.discourse-cdn.com/flex016/user_avatar/devforum.zoom.us/viral.webosmotic/32/58933_2.png) [@viral.webosmotic](https://devforum.zoom.us/u/viral.webosmotic)\
**Post date:** [April 23, 2024, 4:53am UTC](https://devforum.zoom.us/t/cors-issue-when-making-an-api-call/108394/3 "2024-04-23T04:53:46Z")

</div>

Thank you for your help, but I was able to solve this issue by adding my server domain to Zoom Marketplace app configuration allowed domain list. But my server has cookie base auth, which need to set Http Only cookie at client side, which is not working as cookies are not getting set. Working on that issue now.

---

<div class="post-metadata">

**Author:** ![MaxM](https://sea2.discourse-cdn.com/flex016/user_avatar/devforum.zoom.us/maxm/32/42303_2.png) [@MaxM](https://devforum.zoom.us/u/MaxM)\
**Post date:** [April 30, 2024, 10:51pm UTC](https://devforum.zoom.us/t/cors-issue-when-making-an-api-call/108394/4 "2024-04-30T22:51:22Z")

</div>

Glad to hear this is working, will help focus on the new issue issue in the new thread 😃

---

<div class="post-metadata">

**Author:** ![MaxM](https://sea2.discourse-cdn.com/flex016/user_avatar/devforum.zoom.us/maxm/32/42303_2.png) [@MaxM](https://devforum.zoom.us/u/MaxM)\
**Post date:** [April 30, 2024, 10:51pm UTC](https://devforum.zoom.us/t/cors-issue-when-making-an-api-call/108394/5 "2024-04-30T22:51:25Z")

</div>