Access Your Data (CORS)

For security reasons, your project is configured by default to only respond to queries from localhost:3333 (i.e. your laptop) and the hostname you used when deploying (if you used sanity deploy). If you want to open up your project to any other origins, you need to add the host name to your allowed CORS origins (you can read more on browser security & CORS or the technicalities of CORS).

Typical reasons you'd want to add a new CORS origin include:

1. You are using a non-default port when developing, so you'd open up to http://localhost:<your port>
2. You are deploying a front end, so you'd open up to https://the-public-host.com
3. You are deploying a studio outside the Sanity infrastructure (i.e. not using the sanity deploy command)
4. You want to try something out on JSFiddle, you'd open to https://fiddle.jshell.net

It's good practice to limit your origins to the smallest possible set, and never open a sensitive dataset to public playgrounds like JSFiddle. A JSFiddle example will be able to access projects you open to it with your credentials when you run it.

A CORS origin will be defined using the following format: protocol://hostname[:port]. The protocol and host name are required while the port is optional. Wildcards (*) are allowed.

Some valid examples include: https://example.org, https://*.example.org, https://fiddle.jshell.net, http://localhost:3000, and http://localhost:3333.

When adding a CORS origin, you will also need to decide whether or not to allow credentials. If you allow credentials, the origin will be allowed to send authenticated requests using the token or session of a logged in user.

You can add a CORS origin from your management console or using the command line interface (CLI).

To add a CORS origin from your management console:

1. Go to https://www.sanity.io/manage
2. Pick your project from the list
3. Go to Settings, and then to API settings
4. Under CORS Origins, click the Add CORS origin button
5. Enter your Origin, select whether or not to Allow credentials, and click Save. If your origin was added successfully, it will appear at the top of your CORS origins list.

To add a CORS origin from the CLI:

1. Navigate to your project's folder in your terminal
2. Run the command sanity cors add [ORIGIN], where [ORIGIN] meets the requirements listed above
3. When prompted, select whether or not to allow credentials

You can confirm your origin was added with the statement CORS origin added successfully or by consulting the list returned by the command sanity cors list.