Why would my fetch() call fail even though this shows CORS headers?

CORS is enforced by the browser per-request, and can depend on the exact request method/headers used (a "preflight" OPTIONS request) — this check shows a plain GET’s headers, which is a strong signal but not a guarantee for every request shape.

What does a wildcard Access-Control-Allow-Origin mean?

* means the response allows cross-origin requests from any website — common for public, read-only APIs; sensitive or authenticated endpoints usually list specific origins instead.

CORS Header Checker

Inspect a URL’s Access-Control-* response headers to see what cross-origin access it allows.

URL

The URL is fetched from our server (an arbitrary cross-origin fetch isn't possible directly from your browser) — the target site sees this server's request, not your IP, and nothing about the check is stored.

Related tools

How it works

1
Enter a URL (often an API endpoint)

Including the protocol.
2
CORS headers read

Access-Control-Allow-Origin/Methods/Headers/Credentials.
3
See what it allows

Whether cross-origin requests are permitted, and from where.

FAQ

Why would my fetch() call fail even though this shows CORS headers?: CORS is enforced by the browser per-request, and can depend on the exact request method/headers used (a "preflight" OPTIONS request) — this check shows a plain GET’s headers, which is a strong signal but not a guarantee for every request shape.
What does a wildcard Access-Control-Allow-Origin mean?: * means the response allows cross-origin requests from any website — common for public, read-only APIs; sensitive or authenticated endpoints usually list specific origins instead.