CORS and calls from the browser

If you call the API directly from the browser (frontend), there are a few things to know:

1. Use a public key, not a live key — a live key must never sit in code the user can see.
2. Lock the public key to your domain (origin allowlist, e.g. https://example.com). This is required: without domains every call is rejected. Calls from other domains are rejected with 403 and a message saying the origin isn't on the allowlist. Add the domain under the key's Configuration → Allowed origins.
3. If you get an actual CORS error in the browser, check your headers: from the browser you may only send Authorization and Content-Type. Other custom headers (e.g. X-Addr-Key) are rejected by the browser's preflight.

If the call should ideally not be visible to the user (e.g. sensitive lookups), make it from your server with a live key instead.