# CORS for Try it

In direct mode the reader's browser calls your API from the reference's page, so the browser asks your API first whether that page's origin may. Without the right answer, the browser blocks the request and Try it can't show the answer. If you can't change your API's headers, use the [proxy](direct-and-proxy) on Pro and up.

## The headers

For a preflight `OPTIONS` request and for the request itself:

```http
Access-Control-Allow-Origin: https://latitude10.tech
Access-Control-Allow-Methods: GET, POST, PUT, PATCH, DELETE
Access-Control-Allow-Headers: Authorization, Content-Type
Access-Control-Expose-Headers: *
```

| Header | Why |
| --- | --- |
| `Access-Control-Allow-Origin` | The origin of the page Try it runs on. For the hosted reference and its embed, that's `https://latitude10.tech`. A docs site on your own domain runs Try it from that domain, so allow it too. |
| `Access-Control-Allow-Methods` | The methods your operations use. |
| `Access-Control-Allow-Headers` | The headers Try it sends: `Authorization` for a bearer or basic credential, `Content-Type` for a body, and the name of any API key header your document describes. |
| `Access-Control-Expose-Headers` | Optional. Without it, Try it shows only the few headers browsers always expose. |

Try it sends no cookies, so your API doesn't need `Access-Control-Allow-Credentials`.

## Where this comes from

- `app/reference/_lib/playground/client.ts`
- `app/reference/_lib/playground/csp.ts`
- `app/workspace/[ws]/[project]/playground/page.tsx`