Fixing CORS errors

1. Find the failing request

Open the browser developer tools, select Network, and submit once. Locate the POST and any preceding OPTIONS request. Confirm you are using the copied public endpoint with /v1/cf_pk_…/submissions, not a dashboard URL or a read endpoint. Record the status and response body when available. A browser CORS message alone does not identify whether the failure is an origin rule, incorrect route, redirect, or unavailable service.

2. Match the website origin

As the owner, open Settings → General → Allowed origins. Add the exact website scheme, host, and port, one origin per line, then save. For example, https://example.com, https://www.example.com, and http://localhost:5173 are distinct. Use origins without page paths. A wildcard such as https://*.example.com matches subdomains, not the apex https://example.com; add the apex separately if needed.

3. Check browser preflight

JSON, PATCH, and custom headers such as Idempotency-Key can trigger an OPTIONS request. Public submission and draft endpoints support preflight. A successful OPTIONS response only means the browser may attempt the request; the actual request still checks form availability and allowed origins. Do not infer endpoint methods from the broader methods advertised in CORS headers. See Customer API endpoints for supported routes.

curl --include --request OPTIONS \
  'https://api.qubeforms.io/v1/cf_pk_YOUR_KEY/submissions' \
  --header 'Origin: https://www.example.com' \
  --header 'Access-Control-Request-Method: POST' \
  --header 'Access-Control-Request-Headers: content-type,idempotency-key'

4. Use the normal fetch request mode

Do not use mode: no-cors; it produces an opaque response your application cannot inspect. Public submission requests do not need dashboard cookies, so avoid credentials: include. Let the browser supply Origin. For multipart uploads, let it set Content-Type too. Request Accept: application/json to handle success in your page without following a thank-you redirect as a fetch response.

5. Check server and local tests

A curl or backend request has no automatic browser Origin. A restricted form rejects requests without an approved origin; use your approved Origin header in integration tests. A curl success does not prove browser CORS works. Test the real page over HTTP or HTTPS rather than opening a local file:// page. Keep private read requests on your server; read routes do not enable cross-origin browser access.

6. Verify the fix

Reload the page after saving origins, send a non-sensitive test, and confirm both the JSON response and the inbox record. If preflight still fails, inspect redirects, HTTPS errors, and any proxy response. Share the failing method, path, origin, time, and status with support through the site, without copying private headers or submission contents.

• Allowed origins and CORS
• Customer API endpoints
• Submit a form