Fix CORS Errors in ToolJet REST API Calls
ToolJet browser queries without CORS preflight failures
ToolJet CORS errors appear when a RunJS query or browser-side fetch hits an API that does not return Access-Control-Allow-Origin for your ToolJet domain. Route the call through a RealComposer pipeline: it handles the OPTIONS preflight, adds the right headers, and injects any upstream auth from the vault.
Why ToolJet browser queries hit CORS blocks
Many internal and vendor APIs were never configured for cross-origin browser calls. When ToolJet code fetches them directly, the browser rejects the response before your query can read it, even though the same request works in cURL.
- Blocked responses on APIs without Access-Control-Allow-Origin
- Teams loosening CORS to * on internal APIs as a workaround
- Auth headers copied into RunJS to get around the block
How RealComposer Solves This at the Edge
Store credentials in Secret Vault
Save UPSTREAM_API_TOKEN in RealComposer so the value never enters the ToolJet project.
Configure the edge pipeline
Add the upstream steps with vault header injection, set allowed origins, and map only the fields the screen binds.
Point the ToolJet query at the edge URL
Call your workspace edge URL with a restricted rc_live_ client token.
// ToolJet RunJS query
const res = await fetch('https://realcomposer.com/v1/workspace/fix-cors-error-tooljet', {
headers: { Authorization: 'Bearer rc_live_client_token' }
});
return await res.json();
{
"data": [
{
"id": "ord_1",
"status": "shipped",
"_links": {
"self": "/v1/1"
}
}
],
"meta": {
"total": 1,
"page": 1,
"request_id": "req_88"
}
}
{
"orders": [
{
"id": "ord_1",
"status": "shipped",
"_links": {
"self": "/v1/1"
}
}
],
"total": 1
}
Recipe Specs
- HTTP method
- GET
- Upstream calls
- 1
- Edge cache TTL
- No caching
- Client auth
- Restricted client token
- Mapped output fields
- 2
- Payload
- 120 B to 82 B (-32%)
curl -X GET "https://realcomposer.com/v1/workspace/fix-cors-error-tooljet" \ -H "Authorization: Bearer rc_live_client_token"
Developer Questions & Troubleshooting
Does ToolJet have its own CORS workaround?
Queries run through ToolJet data sources are executed by the ToolJet server, so they avoid browser CORS. RunJS fetches do not. RealComposer covers the browser case and also adds caching and slimming.
Which origins should I allow?
Add your ToolJet Cloud or self-hosted app domain to the pipeline allowed origins and leave every other origin blocked.
Sources & Definitions Used in This Answer
Deploy this ToolJet + REST API Recipe
Clone this pre-configured pipeline into your RealComposer workspace in one click. We pre-populate upstream URLs, headers, and mapping rules.