--- title: "CORS error only on the live site" description: "CORS errors on the live site usually mean a function allows the preview origin but not your domain. How to read the console and fix the server header." url: https://whocanfixmyapp.com/problems/cors-error-only-on-the-live-site --- [Home](https://whocanfixmyapp.com/) / [Problems](https://whocanfixmyapp.com/problems) / [Screens and forms](https://whocanfixmyapp.com/problems#screens-and-forms) # CORS error only on the live site VC-52 · Vercel · Netlify · Supabase · Updated October 2026 · By [Nathaniel Kelley](https://whocanfixmyapp.com/authors/nathaniel-kelley) Quick verdict Partly fixable yourself. Often one missing header or one missing allowed origin. - **How serious**: Medium - **Fix it yourself?**: Partly, some steps need a developer - **Typical cost**: €99–$990 for a single fix ([prices](https://whocanfixmyapp.com/pricing)) - **Top rated for Supabase**: [Redlab](https://whocanfixmyapp.com/companies/redlab) · **10.0**/10 **What you see.** The app works in preview, but on the live domain requests fail and the browser console shows a CORS error. ## Why it happens CORS stands for cross-origin resource sharing. It is a browser rule. A page on one domain may only read a response from another domain if that server says so, with a header called `Access-Control-Allow-Origin`. Your preview URL was allowed, your live domain is not. The browser blocks the response and only shows the reason in the console, so your app just sees a failed request. With AI-built apps the server piece is usually a Supabase Edge Function, a `/api` route on Vercel, or a Netlify function. The function either never answers the preflight `OPTIONS` request, or returns the header only for the old origin. On Netlify, rules in the `_headers` file apply to static files only, not to functions, so a header added there does nothing for your API. The fix is always on the server, never in the browser. ## Fix it yourself 1. Open the live site, press F12 and read the **Console**. The line starting with Reason tells you which header is missing or which origin does not match. 2. In the **Network** tab click the red request. Its URL shows what is being called: a Supabase Edge Function, a Vercel `/api` route, or a Netlify function. 3. Supabase Edge Function: it must answer `OPTIONS` and return `corsHeaders` on every response, including errors. Ask your builder to use the `withSupabase` wrapper or import `corsHeaders` from `@supabase/supabase-js`. 4. Vercel or Netlify function: the function code itself must set `Access-Control-Allow-Origin` to your live domain. A headers block in `vercel.json` or `_headers` only covers static files. 5. Add the live domain exactly as the browser shows it, with https and no trailing slash. Redeploy, then hard refresh the live site. 6. Never fix this by calling Supabase with the secret key from the browser or by routing through a public CORS proxy. Both leak data. ## When to get an engineer Stop and get an engineer when the failing calls are spread across several functions, or when the error moves to a different header each time the AI touches it. Tell them the exact console message, the failing URL, and your live domain. A single fix is €99–$990 and takes about two days, and it should include a check that every function returns the same headers on success and on error. ## Top-rated companies for Supabase apps Ranked by our score: published prices, scope of work, AI tools named, timing and a low-risk first step. [How we score](https://whocanfixmyapp.com/methodology#score). - 1 · [Redlab](https://whocanfixmyapp.com/companies/redlab) · **10.0**/10 · Best for: A full rescue by one team that keeps building · Free first step · from $490 - 2 · [Vibe Code Rescue (Lev Arakelyan)](https://whocanfixmyapp.com/companies/vibe-code-rescue-lev-arakelyan) · **9.0**/10 · Best for: A one-off check and a cleanup · From $299 - 3 · [LazyCodeLab](https://whocanfixmyapp.com/companies/lazycodelab) · **9.0**/10 · Best for: A one-off check and a cleanup · From $399 [All 29 Supabase companies, ranked](https://whocanfixmyapp.com/best/supabase-developers) ## Check these DATA-02 · Critical No secret keys reach the browser Open your live app, then DevTools, Sources, and search the loaded JavaScript for `sb_secret_`, `sk_live_`, `sk-proj-` and `sk-ant-`. Older Supabase keys are long tokens starting with `eyJ`: decode the middle part of each on your own machine, and if it contains `"role":"service_role"`, your secret key is public. A publishable or anon key in the browser is expected. OPS-04 · Medium Secrets live in the host's environment settings Keys belong in environment variables on the server, not in the repository or in front-end code. PAY-03 · High Input is validated on the server Forms that only check input in the browser accept anything sent directly to the API. ## Questions ### Why does it work in the Lovable or Bolt preview? The preview runs on a domain the function already allows, often with a wildcard. Your custom domain is a new origin the server has not been told about. ### Is a CORS error a security problem? The error itself is the browser protecting you. The danger is in quick fixes: allowing every origin on a function that uses a secret key, or moving the secret key into the browser. Sources: [MDN: CORS errors](https://developer.mozilla.org/en-US/docs/Web/HTTP/Guides/CORS/Errors); [Supabase: CORS for Edge Functions](https://supabase.com/docs/guides/functions/cors); [Netlify: custom headers](https://docs.netlify.com/manage/routing/headers/); [Vercel: vercel.json headers](https://vercel.com/docs/project-configuration/vercel-json). **Supabase guide** What Supabase builds, where it breaks and how to check it: [Supabase RLS audit: how to check an AI-built app's database rules](https://whocanfixmyapp.com/guides/supabase). **Same category** - [Hydration error after deploy](https://whocanfixmyapp.com/problems/hydration-error-after-deploy) - [Form submits but nothing happens](https://whocanfixmyapp.com/problems/form-submits-but-nothing-happens) - [Looks fine on desktop, broken on phones](https://whocanfixmyapp.com/problems/looks-fine-on-desktop-broken-on-phones) - [Images and files not loading after deploy](https://whocanfixmyapp.com/problems/images-not-loading-after-deploy) - [App is stuck on a loading spinner](https://whocanfixmyapp.com/problems/stuck-on-a-loading-spinner) [All screens and forms problems](https://whocanfixmyapp.com/problems#screens-and-forms) **Run every check** The [production checklist](https://whocanfixmyapp.com/checklist) has all 24 checks with a verdict.