Fix CORS Errors in WeWeb API Requests
WeWeb REST calls that pass preflight and keep auth private
WeWeb CORS errors happen when an API does not allow your WeWeb domain as an origin. Rather than adding auth headers to a proxied request in the app, call a RealComposer pipeline. It answers the OPTIONS preflight, returns the correct CORS headers, and attaches upstream credentials at the edge.
Why WeWeb requests fail CORS checks
Browsers block cross-origin responses unless the API opts in. Many vendor and internal APIs do not list WeWeb editor or production domains, so collections fail with a CORS error even when the request is otherwise valid.
- Collections failing only in the browser, not in testing tools
- Auth headers kept in the app while routing through a CORS proxy
- Different behavior between WeWeb editor and published domains
How RealComposer Solves This at the Edge
Store credentials in Secret Vault
Save UPSTREAM_API_TOKEN in RealComposer so the value never enters the WeWeb project.
Configure the edge pipeline
Add the upstream steps with vault header injection, set allowed origins, and map only the fields the screen binds.
Swap the WeWeb collection URL
Call your workspace edge URL with a restricted rc_live_ client token.
// WeWeb REST API collection
URL: https://realcomposer.com/v1/workspace/fix-cors-error-weweb
Headers: Authorization: Bearer rc_live_client_token
Proxy through WeWeb server: off
{
"results": [
{
"id": "lst_4",
"title": "Loft",
"price": 1800
}
],
"pagination": {
"next": null
},
"debug": {
"region": "us-east-1"
}
}
{
"items": [
{
"id": "lst_4",
"title": "Loft",
"price": 1800
}
]
}
Recipe Specs
- HTTP method
- GET
- Upstream calls
- 1
- Edge cache TTL
- No caching
- Client auth
- Restricted client token
- Mapped output fields
- 1
- Payload
- 114 B to 54 B (-53%)
curl -X GET "https://realcomposer.com/v1/workspace/fix-cors-error-weweb" \ -H "Authorization: Bearer rc_live_client_token"
Developer Questions & Troubleshooting
Should I add both WeWeb editor and production domains?
Yes. Add the editor preview domain and your published domain to allowed origins so collections work while building and after launch.
Do I still need the WeWeb server proxy?
No. The RealComposer edge already returns valid CORS headers, so the request can go straight from the browser.
Sources & Definitions Used in This Answer
Deploy this WeWeb + REST API Recipe
Clone this pre-configured pipeline into your RealComposer workspace in one click. We pre-populate upstream URLs, headers, and mapping rules.