CORS for Try it
In direct mode the reader's browser calls your API from the reference's page, so the browser asks your API first whether that page's origin may. Without the right answer, the browser blocks the request and Try it can't show the answer. If you can't change your API's headers, use the proxy on Pro and up.
The headers
For a preflight OPTIONS request and for the request itself:
Access-Control-Allow-Origin: https://latitude10.tech
Access-Control-Allow-Methods: GET, POST, PUT, PATCH, DELETE
Access-Control-Allow-Headers: Authorization, Content-Type
Access-Control-Expose-Headers: *| Header | Why |
|---|---|
Access-Control-Allow-Origin | The origin of the page Try it runs on. For the hosted reference and its embed, that's https://latitude10.tech. A docs site on your own domain runs Try it from that domain, so allow it too. |
Access-Control-Allow-Methods | The methods your operations use. |
Access-Control-Allow-Headers | The headers Try it sends: Authorization for a bearer or basic credential, Content-Type for a body, and the name of any API key header your document describes. |
Access-Control-Expose-Headers | Optional. Without it, Try it shows only the few headers browsers always expose. |
Try it sends no cookies, so your API doesn't need Access-Control-Allow-Credentials.
Where this comes from
app/reference/_lib/playground/client.tsapp/reference/_lib/playground/csp.tsapp/workspace/[ws]/[project]/playground/page.tsx