CORS (Cross-Origin Resource Sharing) is a browser security rule: JavaScript on one origin (site) cannot read responses from a different origin unless that server explicitly allows it with Access-Control-Allow-* headers. It only applies in browsers — curl and n8n are unaffected.
- A "simple" GET goes straight through; the browser just checks the response headers.
- A "non-simple" request (custom header or JSON content-type) triggers a preflight OPTIONS first, asking permission.
- If the server does not allow your origin, the browser blocks the response — you see "Failed to fetch", even though the request reached the server.
Tip · Open the CORS demo page (linked from the portal) with DevTools → Network open. It runs in your browser on a different origin than the API, so you can watch the preflight OPTIONS and the Access-Control-Allow-Origin header live.