#8 most commonruntime/UILovableBolt.newCursorReplitv0Windsurf

Blocked by CORS policy (No 'Access-Control-Allow-Origin' header)

Access to fetch at 'https://api...' from origin 'https://myapp...' has been blocked by CORS policy: Response to preflight request doesn't pass access control check: No 'Access-Control-Allow-Origin' header is present on the requested resource.

Got a slightly different error? Paste the exact message and get a fix prompt tailored to it.

Paste your error →

What it means

Browsers only let your site talk to another server if that server says 'yes, that website is allowed'. The server you're calling didn't say that, so the browser blocked the request.

How to fix it: paste this prompt into your AI builder

Fix prompt for Lovable, Bolt, Cursor, Replit, v0, Windsurf
My app gets a CORS error calling an API. Fix it on the server side, not by disabling security: if it's my own backend or Supabase Edge Function, handle the OPTIONS preflight request first and return Access-Control-Allow-Origin, Access-Control-Allow-Headers (including authorization, apikey, content-type, x-client-info) and Access-Control-Allow-Methods on EVERY response, including error responses. If it's a third-party API that doesn't allow browser calls, move the call into a server route/edge function and call that instead (and keep any secret API key on the server). Change only the request path involved.

If the AI can't fix it: manual steps

  1. Never put a secret API key in frontend code to 'work around' CORS.
  2. After changing an Edge Function, it must be redeployed.

Where this happens

Seen in these AI app builders and editors:

LovableBolt.newCursorReplitv0Windsurf

Sources

Related runtime/UI errors

Still stuck? Paste your full error and UnstuckMyVibe will match it and hand you the exact fix prompt.

Fix my error →